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Re-keying Mechanisms for Symmetric Keys 
Abstract 


A certain maximum amount of data can be safely encrypted when 
encryption is performed under a single key. This amount is called 
the "key lifetime". This specification describes a variety of 
methods for increasing the lifetime of symmetric keys. It provides 
two types of re-keying mechanisms based on hash functions and block 
ciphers that can be used with modes of operations such as CTR, GCM, 
CBC, CFB, and OMAC. 
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1. Introduction 


A certain maximum amount of data can be safely encrypted when 
encryption is performed under a single key. Hereinafter, this amount 
will be referred to as the "key lifetime". The need for such a 
limitation is dictated by the following methods of cryptanalysis: 


1. Methods based on the combinatorial properties of the used block 
cipher mode of operation 


These methods do not depend on the underlying block cipher. 
Common mode restrictions derived from such methods are of 
order 2*%{n/2}, where n is a block size defined in Section 3. 
[Sweet32] includes an example of an attack that is based on 
such methods. 


2. Methods based on side-channel analysis issues 


In most cases, these methods do not depend on the used 
encryption modes and weakly depend on the used cipher 
features. Limitations resulting from these considerations are 
usually the most restrictive ones. [TEMPEST] is an example of 
an attack that is based on such methods. 


3. Methods based on the properties of the used block cipher 


The most common methods of this type are linear and 
differential cryptanalysis [LDC]. In most cases, these 
methods do not depend on the used modes of operation. In the 
case of secure block ciphers, bounds resulting from such 
methods are roughly the same as the natural bounds of 2^n and 
are dominated by the other bounds above. Therefore, they can 
be excluded from the considerations here. 


As a result, it is important to replace a key when the total size of 
the processed plaintext under that key approaches the lifetim 
limitation. A specific value of the key lifetime should be 
determined in accordance with some safety margin for protocol 
security and the methods outlined above. 


Suppose L is a key lifetime limitation in some protocol P. For 
simplicity, assume that all messages have the same length m. Hence, 
the number of messages q that can be processed with a single key K 
should be such that m * q <= L. This can be depicted graphically as 
a rectangle with sides m and q enclosed by area L (see Figure 1). 
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Figure 1: Graphic Display of the Key Lifetime Limitation 


In practice, the amount of data that corresponds to limitation L may 
not be enough. The simplest and obvious solution in this situation 
is a regular renegotiation of an initial key after processing this 
threshold amount of data L. However, this reduces the total 
performance, since it usually entails termination of application data 
transmission, additional service messages, the use of a random number 
generator, and many other additional calculations, including 
resource-intensive public key cryptography. 


For protocols based on block ciphers or stream ciphers, a more 
efficient way to increase the key lifetime is to use various 


re-keying mechanisms. This specification considers re-keying 
mechanisms for block ciphers only; re-keying mechanisms typical for 
stream ciphers (e.g., [Pietrzak2009], [FPS2012]) are beyond the scope 


of this document. 


Re-keying mechanisms can be applied at the different protocol levels: 
the block cipher level (this approach is known as fresh re-keying and 
is described, for instance, in [FRESHREKEYING]; the block cipher mode 
of operation level (see Section 6); and the protocol level above the 
block cipher mode of operation (see Section 5). The usage of the 
first approach is highly inefficient due to the key changing after 
each message block is processed. Moreover, fresh re-keying 
mechanisms can change the block cipher internal structure and, 
consequently, can require an additional security analysis for each 
particular block cipher. As a result, this approach depends on 
particular primitive properties and cannot be applied to any 
arbitrary block cipher without additional security analysis. 
Therefore, fresh re-keying mechanisms go beyond the scope of this 
document. 


Thus, this document contains the list of recommended re-keying 
mechanisms that can be used in the symmetric encryption schemes based 
on the block ciphers. These mechanisms are independent from the 
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particular block cipher specification, and their security properties 
rely only on the standard block cipher security assumption. 


This specification presents two basic approaches to extending the 
lifetime of a key while avoiding renegotiation, which were introduced 
in [AAOS2017]: 


1. External re-keying 
External re-keying is performed by a protocol, and it is 


independent of the underlying block cipher and the mode of 
operation. External re-keying can use parallel and serial 


constructions. In the parallel case, data processing keys K^1, 
K“2, ... are generated directly from the initial key K 
independently of each other. In the serial case, every data- 


processing key depends on the state that is updated after the 
generation of each new data-processing key. 


As a generalization of external parallel re-keying, an external 
tree-based mechanism can be considered. It is specified in 
Section 5.2.3 and can be viewed as the tree generalization in 
[GGM]. Similar constructions are used in the one-way tree 
mechanism ([OWT]) and [AESDUKPT] standard. 


2. Internal re-keying 


Internal re-keying is built into the mode, and it depends heavily 
on the properties of the mode of operation and the block size. 


The re-keying approaches extend the key lifetime for a single initial 
key by allowing the leakages to be limited (via side channels) and by 
improving the combinatorial properties of the used block cipher mode 

of operation. 


In practical applications, re-keying can be useful for protocols that 
need to operate in hostile environments or under restricted resource 
conditions (e.g., those that require lightweight cryptography, where 
ciphers have a small block size that imposes strict combinatorial 
limitations). Moreover, mechanisms that use external or internal 
re-keying may provide some protection against possible future attacks 
(by limiting the number of plaintext-ciphertext pairs that an 
adversary can collect) and some properties of forward or backward 
security (meaning that past or future data-processing keys remain 
secure even if the current key is compromised; see [AbBell] for more 
details). External or internal re-keying can be used in network 
protocols as well as in the systems for data-at-rest encryption. 
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Depending on the concrete protocol characteristics, there might be 
situations in which both external and internal re-keying mechanisms 
(see Section 7) can be applied. For example, a similar approach was 
used in Taha’s tree construction (see [TAHA]). 


Note that there are key-updating (key regression) algorithms (e.g., 
[FKK2005] and [KMNT2003]) that are called "re-keying" as well, but 
they pursue goals other than increasing the key lifetime. Therefore, 
key regression algorithms are excluded from the considerations here. 


This document represents the consensus of the Crypto Forum Research 
Group (CFRG). 


2. Conventions Used in This Document 
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", “SHALL NOT", 
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 


"OPTIONAL" in this document are to be interpreted as described in 
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all 
capitals, as shown here. 


3. Basic Terms and Definitions 


This document uses the following terms and definitions for the sets 
and operations on the elements of these sets: 


vx the set of all bit strings of a finite length (hereinafter 
referred to as strings), including the empty string; 
V_s the set of all bit strings of length s, where s is a 


non-negative integer; 
|x| the bit length of the bit string X; 


A | B the concatenation of strings A and B both belonging to V*, 
i.e., a string in V_{|A|+|B|}, where the left substring in 
v_|A| is equal to A and the right substring in V_|B| is equal 
to B; 


(xor) the exclusive-or of two bit strings of the same length; 
Z_{2^n} the ring of residues modulo 2^n; 
Int_s: V_s -> Z_{2%s} 
the transformation that maps the string a = (as, ... , a_l) 
in V_s into the integer Int_s(a) = 2*{s-1} * a s + ... +2 * 


a_2 + a_l (the interpretation of the binary string as an 
integer): 
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Vec_s: Z_{2%s} -> V_s 
the transformation inverse to the mapping Int_s (the 
interpretation of an integer as a binary string); 


MSB i: V_s — Vi 
the transformation that maps the string a (487. ess ur aL) 
in V_s into the string MSB i(a) = (as, ... , a fs-itl)) in 
V_i (most significant bits); 


LSB i: V s — V i 
the transformation that maps the string a = 
in V_s into the string LSB_i(a) = (a_i, ... , a_l) in Vi 
(least significant bits); 


| 
w 
n 
w 
pt 


Inc c: V s -> V s 


the transformation that maps the string a = (as, ... , a_l) 
in V_s into the string Inc_c(a) = MSB_{|la|-c}(a) | 
Vec_c(Int_c(LSB_c(a)) + 1(mod 2%c)) in V_s (incrementing the 


least significant c bits of the bit string, regarded as the 
binary representation of an integer); 


a^s the string in V_s that consists of s 'a' bits; 


E_{K}: Vin -> Vin 
the block cipher permutation under the key K in V_k; 


ceil(x) the smallest integer that is greater than or equal to x; 


floor (x) 
the biggest integer that is less than or equal to x; 


k the bit length of the K; k is assumed to be divisible by 8; 


n the block size of the block cipher (in bits); n is assumed to 
be divisible by 8; 


b the number of data blocks in the plaintext P (b = 
ceil(|P|/n)); 


N the section size (the number of bits that are processed with 
one section key before this key is transformed). 


A plaintext message P and the corresponding ciphertext C are divided 


into b = ceil(|P|/n) blocks, denoted as P = P1 | P2 |... | Pb and 
C-cCc1 |c2 |... | Cb, respectively. The first b-1 blocks P_i 
and C_i are in V_n for i = 1, 2, ... , b-1. The b-th blocks Pb and 
Cb may be incomplete blocks, i.e., in Vr, where r <= n if not 


otherwise specified. 
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4. Choosing Constructions and Security Parameters 


External re-keying is an approach assuming that a key is transformed 
after encrypting a limited number of entire messages. The external 
re-keying method is chosen at the protocol level, regardless of the 
underlying block cipher or the encryption mode. External re-keying 
is recommended for protocols that process relatively short messages 
or protocols that have a way to divide a long message into manageable 
pieces. Through external re-keying, the number of messages that can 
be securely processed with a single initial key K is substantially 
increased without a loss of message length. 


External re-keying has the following advantages 


1. It increases the lifetime of an initial key by increasing the 
number of messages processed with this key. 


2. It has minimal impact on performance when the number of messages 
processed under one initial key is sufficiently large. 


3. It provides forward and backward security of data-processing 
keys. 


However, the use of external re-keying has the following 
disadvantage: in cases with restrictive key lifetime limitations, the 
message sizes can become obstructive due to the impossibility of 
processing sufficiently large messages, so it may be necessary to 
perform additional fragmentation at the protocol level. For example, 
if the key lifetime L is 1 GB and the message length m = 3 GB, then 
this message cannot be processed as a whole, and it should be divided 
into three fragments that will be processed separately. 


Internal re-keying is an approach assuming that a key is transformed 
during each separate message processing. Such procedures are 
integrated into the base modes of operations, so every internal 
re-keying mechanism is defined for the particular operation mode and 
the block size of the used cipher. Internal re-keying is recommended 
for protocols that process long messages: the size of each single 
message can be substantially increased without loss in the number of 
messages that can be securely processed with a single initial key. 


Internal re-keying has the following advantages: 


1. It increases the lifetime of an initial key by increasing the 
size of the messages processed with one initial key. 


2. It has minimal impact on performance. 


Smyshlyaev Informational [Page 9] 


RFC 8645 Re-keying Mechanisms for Symmetric Keys August 2019 


3. Internal re-keying mechanisms without a master key do not affect 
short-message transformation at all. 


4. It is transparent (works like any mode of operation): it does not 
require changes of initialization vectors (IVs) and a restart of 
MACing. 


However, the use of internal re-keying has the following 


disadvantages: 

1. a specific method must not be chosen independently of a mode of 
operation. 

2. internal re-keying mechanisms without a master key do not provide 


backward security of data-processing keys. 


Any block cipher modes of operations with internal re-keying can be 
jointly used with any external re-keying mechanisms. Such joint 
usage increases both the number of messages processed with one 
initial key and their maximum possible size. 


If the adversary has access to the data-processing interface, the use 
of the same cryptographic primitives both for data-processing and 
re-keying transformation decreases the code size but can lead to some 
possible vulnerabilities (the possibility of mounting a chosen- 
plaintext attack may lead to the compromise of the following keys). 
This vulnerability can be eliminated by using different primitives 
for data processing and re-keying, e.g., block cipher for data 
processing and hash for re-keying (see Section 5.2.2 and 


Section 5.3.2). However, in this case, the security of the whole 
scheme cannot be reduced to standard notions like a pseudorandom 
function (PRF) or pseudorandom permutation (PRP), so security 


estimations become more difficult and unclear. 


Summing up the abovementioned issues briefly: 


1. If a protocol assumes processing of long records (e.g., [CMS]), 
internal re-keying should be used. If a protocol assumes 
processing of a significant number of ordered records, which can 
be considered as a single data stream (e.g., [TLS], [SSH]), 
internal re-keying may also be used. 


2. For protocols that allow out-of-order delivery and lost records 
(e.g., [DTLS], [ESP]), external re-keying should be used as, in 
this case, records cannot be considered as a single data stream. 
If the records are also long enough, internal re-keying should 
also be used during each separate message processing. 
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For external re-keying: 

1. If it is desirable to separate transformations used for data 
processing and key updates, hash function-based re-keying should 
be used. 

2. If parallel data processing is required, then parallel external 
re-keying should be used. 

3. If restrictive key lifetime limitations are present, external 
tree-based re-keying should be used. 

For internal re-keying: 

1. If the property of forward and backward security is desirable for 
data-processing keys and if additional key material can be easily 
obtained for the data-processing stage, internal re-keying with a 
master key should be used. 

5. External Re-keying Mechanisms 


This section presents an approach to increasing the initial key 
lifetime by using a transformation of a data-processing key (frame 


key) 


The 


after processing a limited number of entire messages (frame). 
approach provides external parallel and serial re-keying 


mechanisms (see [AbBell]). These mechanisms use initial key K only 


for 


processing. Such mechanisms operate outside of the base modes of 


frame key generation and never use it directly for data 


operations and do not change them at all; therefore, they are called 
"external re-keying" mechanisms in this document. 


External re-keying mechanisms are recommended for usage in protocols 
that process quite small messages, since the maximum gain in 
increasing the initial key lifetime is achieved by increasing the 
number of messages. 


External re-keying increases the initial key lifetime through the 
following approach. Suppose there is a protocol P with some mode of 
operation (base encryption or authentication mode). Let Ll be a key 
lifetime limitation induced by side-channel analysis methods (side- 


channel limitation), let L2 be a key lifetime limitation induced by 
methods based on the combinatorial properties of a used mode of 
operation (combinatorial limitation), and let ql, q2 be the total 
numbers of messages of length m that can be safely processed with an 
initial key K according to these limitations. 
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Let L = min(L1, L2), q = min(ql, q2), and q * m <= L. As the Ll 


limitation is usually much stronger than the L2 limitation (L1 < L2), 
the final key lifetime restriction is equal to the most restrictive 
limitation L1. Thus, as displayed in Figure 2, without re-keying, 


only gl (ql * m <= L1) messages can be safely processed. 


<-------- m--—————— » 
+ La Se ee Fee Ge ma Oe E ee ea a E + AN 
K--> ql 
L1| | 
4+---------------- tv 
q2 
L2 
4+---------------- + v 


Figure 2: Basic Principles of Message Processing 
without External Re-keying 


Suppose that the safety margin for the protocol P is fixed and the 
external re-keying approach is applied to the initial key K to 


generate the seguence of frame keys. The frame keys are generated in 
such a way that the leakage of a previous frame key does not have any 
impact on the following one, so the side-channel limitation Ll is 


switched off. Thus, the resulting key lifetime limitation of the 
initial key K can be calculated on the basis of a new combinatorial 
limitation L2’. It is proven (s [AbBell]) that the security of the 
mode of operation that uses external re-keying leads to an increase 
when compared to base mode without re-keying (thus, L2 < L2’). 

Hence, as displayed in Figure 3, the resulting key lifetime 
limitation if using external re-keying can be increased up to L2’. 
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<-------- m------- > 
K 4+---------------- + 
vV 
K*1--> 
L1 
4+---------------- + 
vV 
K^2--> 
L1 
4+---------------- + 
vV 
L2 
4+---------------- + 
L2’ 
4+---------------- + 


Figure 3: Basic Principles of Message Processing 
with External Re-keying 


Note: The key transformation process is depicted in a simplified 
form. A specific approach (parallel and serial) is described below. 


Consider an example. Let the message size in a protocol P be equal 
to 1 KB. Suppose L1 = 128 MB and L2 = 1 TB. Thus, if an external 
re-keying mechanism is not used, the initial key K must be 
renegotiated after processing 128 MB / 1 KB = 131072 messages. 


If an external re-keying mechanism is used, the key lifetim 
limitation L1 goes off. Hence, the resulting key lifetime limitation 
L2’ can be set to more than 1 TB. Thus, if an external re-keying 
mechanism is used, more than 1 TB / 1 KB = 2%30 messages can be 
processed before the initial key K is renegotiated. This is 8192 
times greater than the number of messages that can be processed when 
an external re-keying mechanism is not used. 
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5.1. Methods of Key Lifetime Control 


Suppose L is an amount of data that can be safely processed with one 
frame key. For iin {1, 2, ... , t}, the frame key K*i (see Figures 
4 and 6) should be transformed after processing q_i messages, where 
q_i can be calculated in accordance with one of the following 
approaches: 


Explicit approach: 


q_i is such that |M*{i,1}| +... + |M*{i,q_i}| <= L, |M*{i,1}]| + 
.. + [M*{i,q_it1}| > L. 

This approach allows use of the frame key K*i in an almost optimal 

way, but it can be applied only when messages cannot be lost or 

reordered (e.g., TLS records). 


Implicit approach: 


Li =L/m max, i=l, ..., t. 

The amount of data processed with one frame key K*i is calculated 
under the assumption that every message has the maximum length 
m_max. Hence, this amount can be considerably less than the key 


lifetime limitation L. On the other hand, this approach can be 
applied when messages may be lost or reordered (e.g., DTLS 
records). 


Dynamic key changes: 


We can organize the key change using the Protected Point to Point 
([P3]) solution by building a protected tunnel between the 
endpoints in which the information about frame key updating can be 
safely passed across. This can be useful, for example, when we 
want the adversary to not detect the key change during the 
protocol evaluation. 


5.2. Parallel Constructions 


External parallel re-keying mechanisms generate frame keys K“1, K^2, 
directly from the initial key K independently of each other. 


The main idea behind external re-keying with a parallel construction 
is presented in Figure 4: 
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Maximum message size = m_max. 


M*{1,1} === 
M* {1,2} 


+->K*1--> NA Sie: ge 
M*{1,q_1} |======== 


M* {2,1} 
M* {2,2} ===== 


Kass >= => K523 Ba Av 
M*{2,q_2} |========== 


M*{t,1} Een EAEN 
M^{t,2} 


+->K*t--> 


M*{t,q_t} |========== 


Figure 4: External Parallel Re-keying Mechanisms 


The frame key K*i, i= 1, ... , t — 1 is updated after processing a 
certain number of messages (s Section 5.1). 
5.2.1. Parallel Construction Based on a KDF on a Block Cipher 


The ExtParallelC re-keying mechanism is based on the key derivation 
function on a block cipher and is used to generate t frame keys as 


follows: 
K*1 | K^2 | ... | K*t = ExtParallelc(K, t * k) = MSB it * 
k} (E_{K} (Vec_n(0)) | 
E_{K}(Vec_n(1)) | ... | E_{K}(Vec_n(R - 1))), 


where R = ceil(t * k/n). 
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5.2.2. Parallel Construction Based on a KDF on a Hash Function 


The ExtParallelH re-keying mechanism is based on the key derivation 
function HKDF-Expand, described in [RFC5869], and is used to generate 
t frame keys as follows: 


K*1 | K*2 | ... | K*t = ExtParallelH(K, t * k) = HKDF-Expand(K, 
label, t * k), 


where label is a string (may be a zero-length string) that is defined 
by a specific protocol. 


5.2.3. Tree-Based Construction 


The application of an external tree-based mechanism leads to the 
construction of the key tree with the initial key K (root key) at the 
0 level and the frame keys K“1, K“2, ... at the last level, as 
described in Figure 5. 


v v 
K{1,1} K{1, W1} 
| | 
| sath | | a | 
v v v v 
K{2,1} K{2,W2} K{2, (W1-1)*W2+1} Ki2,W1“w2) 
an] SN] h eae | 
v v v v v v v v 
Sista iie oe Sige ies ny ...  K{3, W1*W2*W3} 
Kab (AGE aa Sale. 
| | | | 
v v v v 
K{h,1}  K{h, Wh} K{h, (W1*...*W{h-1}-1)*Wh+1} K{h,W1*...*Wh} 
// \\ // \\ 
K*1 K* {Wh} KA (W1*...*W{h-1}-1) *Wh+1} K*{W1*...*Wh} 


Figure 5: External Tree-Based Mechanism 


The tree height h and the number of keys Wj, j in {1, ... , h}, which 
can be partitioned from the "parent" key, are defined in accordance 
with a specific protocol and key lifetime limitations for the used 
derivation functions. 
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Each j-level key K{j,w}, where j in {1, ... , h}, win {1, ... , W * 

* Wj}, is derived from the (j-1)-level "parent" key K{j-1, 
ceil(w/Wi)} (and other appropriate input data) using the j-th level 
derivation function. This function can be based on the block cipher 
function or on the hash function and is defined in accordance with a 
specific protocol. 


The i-th frame K*i, i in (l, 2, ... , W1*...*Wh}, can be calculated 
as follows: 


K*i = ExtKeyTree(K, i) = KDF_h(KDF_{h-1}(... KDF_1(K, ceil(i / (W2 
* ... * Wh)) ... , ceil(i / Wh)), i), 


where KDF_j is the j-th level derivation function that takes two 
arguments (the parent key value and the integer in a range from 1 to 
Wil * ... * Wj) and outputs the j-th level key value. 


The frame key K^i is updated after processing a certain number of 
messages (see Section 5.1). 


In order to create an efficient implementation, during frame key K'i 
generation, the derivation functions KDF_j, j in (l, ... , h-1} 
should be used only when ceil(i / (W{j+1} * ... * Wh)) != ceil ((i - 
1) / (W{j+1} * ... * Wh)); otherwise, it is necessary to use a 
previously generated value. This approach also makes it possible to 
take countermeasures against side-channel attacks. 


Consider an example. Suppose h = 3, W1 = W2 = W3 = W, and KDF 1, 
KDF_2, KDF_3 are key derivation functions based on the 
KDF GOSTR3411 2012 256 (hereafter simply KDF) function described in 


[RFC7836]. The resulting ExtKeyTree function can be defined as 
follows: 
ExtKeyTree(K, i) = KDF (KDF (KDF (K, "levell", ceil(i / W%2)), 
"level2", ceil(i / W)), "level3", i). 
where i in {1; 2; aw. ip Wih 


A structure similar to the external tree-based mechanism can be found 
in Section 6 of [NISTSP800-108]. 


5.3. Serial Constructions 
External serial re-keying mechanisms generate frame keys, each of 
which depends on the secret state (K“ 1, K*_2, ...) that is updated 


after the generation of each new frame key; see Figure 6. Similar 
approaches are used in the [SIGNAL] protocol and the [TLS] updating 
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traffic key mechanism and were proposed for use in the [U2F] 
protocol. 


External serial re-keying mechanisms have the obvious disadvantage of 
being impossible to implement in parallel, but they may be the 
preferred option if additional forward secrecy is desirable. If all 
keys are securely deleted after usage, the compromise of a current 
secret state at some point does not lead to a compromise of all 
previous secret states and frame keys. In terms of [TLS], compromise 
of application_traffic_secret_N does not compromise all previous 
application traffic secret i, i < N. 


The main idea behind external re-keying with a serial construction is 
presented in Figure 6: 


Maximum message size = m max. 


M* {1,1} === 
M^{1,2} 


K*_1 = K --->K*1--> Lag mi 
M^{1,q_1} |======== 


M^{2,1} 
v M^{2,2} ===== 
Ke DE >K^2--> 


M*{2,q_2} |========== 


M^{t,1} ——————-————- 
Vv M*{t,2} 
SO Ore >K^t--> 


M*{t,q_t} |========== 


Figure 6: External Serial Re-keying Mechanisms 


The frame key K^i, i= 1, ... , t — 1, is updated after processing a 
certain number of messages (see Section 5.1). 
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5.3.1. Serial Construction Based on a KDF on a Block Cipher 


The frame key K^i is calculated using the ExtSerialC transformation 
as follows: 


K*i = ExtSerialC(K, i) = 
MSB_k (E_{K*_i} (Vec_n(0)) |E_{K*_i} (Vec_n(1)) | ... | 
E (K“ i) (Vec_n(J - 1))), 

where J = ceil(k / n), i= 1, ... , t, K*_i is calculated as follows: 
K*_1 = K, 
K*_{j+1} = MSB k(E (K" j) (Vec_n(J)) | E_{K*_j}(Vec_n(J + 1)) | 


E_{K*_j} (Vec_n(2 * J - 1))), 
where: j = 1, ..., t- ods 
5.3.2. Serial Construction Based on a KDF on a Hash Function 


The frame key K^i is calculated using the ExtSerialH transformation 
as follows: 


K*i = ExtSerialH(K, i) = HKDF-Expand(K*_i, labell, k), 
where i = 1, ... , t; HKDF-Expand is the HMAC-based key derivation 
function, as described in [RFC5869]; and K*_i is calculated as 
follows: 

K“ 1 = K, 

K*_{j+1} = HKDF-Expand(K*_j, label2, k), where j= 1, ..., t - 1, 


where labell and label2 are different strings from V* that are 
defined by a specific protocol (see, for example, the algorithm for 
updating traffic keys in TLS 1.3 [TLS]). 


5.4. Using Additional Entropy during Re-keying 


In many cases, using additional entropy during re-keying won’t 


increase security but may give a false sense of that. Therefore, one 
can rely on additional entropy only after conducting a deep security 
analysis. For example, good PRF constructions do not require 


additional entropy for the quality of keys, so, in most cases, there 
is no need to use additional entropy with external re-keying 
mechanisms based on secure KDFs. However, in some situations, mixed- 
in entropy can still increase security in the case of a time-limited 
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but complete breach of the system when an adversary can access the 
frame-key generation interface but cannot reveal the master keys 
(e.g., when the master keys are stored in a Hardware Security Module 
(HSM)). 


For example, an external parallel construction based on a KDF on a 
hash function with a mixed-in entropy can be described as follows: 


K*i = HKDF-Expand(K, label_i, k), 


where label_i is additional entropy that must be sent to the 
recipient (e.g., sent jointly with an encrypted message). The 
entropy label i and the corresponding key K*i must be generated 
directly before message processing. 


6. Internal Re-keying Mechanisms 


This section presents an approach to increasing the key lifetime by 
using a transformation of a data-processing key (section key) during 

ach separate message processing. Each message is processed starting 
with the same key (the first section key), and each section key is 
updated after processing N bits of the message (section). 


This section provides internal re-keying mechanisms called ACPKM 
(Advanced Cryptographic Prolongation of Key Material) and ACPKM- 
Master that do not use a master key and use a master key, 
respectively. Such mechanisms are integrated into the base modes of 
operation and actually form new modes of operation. Therefore, they 
are called "internal re-keying" mechanisms in this document. 


Internal re-keying mechanisms are recommended to be used in protocols 
that process large single messages (e.g., CMS messages), since the 
maximum gain in increasing the key lifetime is achieved by increasing 
the length of a message, while it provides almost no increase in the 
number of messages that can be processed with one initial key. 


Internal re-keying increases the key lifetime through the following 
approach. Suppose protocol P uses some base mode of operation. Let 
L1 and L2 be a side channel and combinatorial limitations, 
respectively, and for some fixed number of messages q, let ml, m2 be 
the lengths of messages that can be safely processed with a single 
initial key K according to these limitations. 


Thus, the approach without re-keying (analogous to Section 5) yields 
a final key lifetime restriction equal to Ll, and only g messages of 
the length ml can be safely processed; see Figure 7. 
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K 
M 
^ $---------------- hb ———————————————————————————————————— + 
| | L1| L2 | 
| | | | 
a | | | 
| | | | 
| | | | 
v t-——————————————— hb ———————————————————————————————————— + 
<------- Milas > 
Rosas SSeS SSS Se SSS SSS SS Sa MALE SE LA LA LA » 


Figure 7: Basic Principles of Message Processing 
without Internal Re-keying 


Suppose that the safety margin for the protocol P is fixed and the 
internal re-keying approach is applied to the base mode of operation. 
Suppose further that every message is processed with a section key, 
which is transformed after processing N bits of data, where N is a 
parameter. If q * N does not exceed Ll, then the side-channel 
limitation L1 goes off, and the resulting key lifetime limitation of 
the initial key K can be calculated on the basis of a new 
combinatorial limitation L2’. The security of the mode of operation 
that uses internal re-keying increases when compared to the base mode 
of operation without re-keying (thus, L2 < L2’). Hence, as displayed 
in Figure 8, the resulting key lifetime limitation if using internal 
re-keying can be increased up to L2’. 


K----- > K*]------------- > K^2 ----------- > 

| | 

vV v 
^ $--------------- 4+--------------- 4------------------ +--...—-+ 

L1 L1 L2 L2” 

a | | | | | 
| | | | | | 
|| | | | | 
v t--------------- 4+--------------- 4+------------------ +--...—-+ 
<------- N------- > 


Figure 8: Basic Principles of Message Processing 
with Internal Re-keying 


Note: The key transformation process is depicted in a simplified 
form. A specific approach (ACPKM and ACPKM-Master re-keying 
mechanisms) is described below. 
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Since the performance of encryption can slightly decrease for rather 
small values of N, the maximum possible value should be selected for 
parameter N for a particular protocol in order to provide the 
necessary key lifetime for the considered security models. 


Consider an example. Suppose L1 = 128 MB and L2 = 10 TB. Let the 
message size in the protocol be large/unlimited (which may exhaust 
the whole key lifetime L2). The most restrictive resulting key 
lifetime limitation is equal to 128 MB. 


Thus, there is a need to put a limit on the maximum message size 
m_max. For example, if m_max = 32 MB, it may happen that the 
renegotiation of initial key K would be required after processing 
only four messages. 


If an internal re-keying mechanism with section size N = 1 MB is 
used, more than L1 / N = 128 MB / 1 MB = 128 messages can be 
processed before the renegotiation of initial key K (instead of four 
messages when an internal re-keying mechanism is not used). Note 
that only one section of each message is processed with the section 
key K*i, and, consequently, the key lifetime limitation L1 goes off. 
Hence, the resulting key lifetime limitation L2' can be set to more 
than 10 TB (in cases when a single large message is processed using 
the initial key K). 


6.1. Methods of Key Lifetime Control 


Suppose L is an amount of data that can be safely processed with one 
section key and N is a section size (fixed parameter). Suppose 
M*{i}_1 is the first section of message M*{i}, i=1, ..., q (see 
Figures 9 and 10); the parameter q can then be calculated in 
accordance with one of the following two approaches: 


o Explicit approach: 
q_i is such that |M^{1}_1| +... + IM VI <= L, [MAL id] +... 
+ |M^{q+1}_1| > L 
This approach allows use of the section key K^i in an almost 
optimal way, but it can be applied only when messages cannot be 
lost or reordered (e.g., TLS records). 


o Implicit approach: 
q=L/N. 
The amount of data processed with one section key K^i is 
calculated under the assumption that the length of every message 
is equal to or greater than section size N and thus can be 
considerably less than the key lifetime limitation L. On the 
other hand, this approach can be applied when messages may be lost 
or reordered (e.g., DTLS records). 


Smyshlyaev Informational [Page 22] 


RFC 8645 Re-keying Mechanisms for Symmetric Keys August 2019 


6. 


6. 


2. 


2. 


Constructions that Do Not Require a Master Key 


This section describes the block cipher modes that use the ACPKM 
re-keying mechanism, which does not use a master key; an initial key 
is used directly for the data encryption. 


1. ACPKM Re-keying Mechanisms 


This section defines a periodical key transformation without a master 
key, which is called the ACPKM re-keying mechanism. This mechanism 
can be applied to one of the base encryption modes (CTR and GCM block 
cipher modes) to get an extension of this encryption mode that uses 
periodical key transformation without a master key. This extension 
can be considered as a new encryption mode. 


An additional parameter that defines the functioning of base 
encryption modes with the ACPKM re-keying mechanism is the section 
size N. The value of N is measured in bits and is fixed within a 
specific protocol based on the requirements of the system capacity 
and the key lifetime. The section size N MUST be divisible by the 
block size n. 


The main idea behind internal re-keying without a master key is 
presented in Figure 9: 


Section size = const = N, 
maximum message size = m_max. 
ACPKM ACPKM ACPKM 
KS1 = K ---> K^2 ---...-> K*{l_max-1} ----> K*{l_max} 
| | | | 
| | | | 
v v v v 
M*{1} | | | gean] | : | 
M^{2} | | |. geis | | 
M*{q} | | | se: 1 | s 
section : 
K—————————— » m max 
N bit 
1 max = ceil(m max/N). 


Figure 9: Internal Re-keying without a Master Key 
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During the processing of the input message M with the length m in 
some encryption mode that uses the ACPKM key transformation of the 


initial key K, the message is divided into 1 = ceil(m / N) sections 
(denoted as M-M1 | M2 |... | M1, where Mi is in V_N for i in 
(1, 2, ... , L= 1} and M_I is in Vt; r <= N). The first section of 
each message is processed with the section key K*1 = K. To process 


the (i + 1)-th section of each message, the section key K^{i+1} is 
calculated using the ACPKM transformation as follows: 


K^{i+1} = ACPKM(K^i) = MSB_k(E_{K^i}(D_1) | ... | E_{K^i}(D_J)), 


where J = ceil(k/n) and D_1, D 2, ... , DJ are in V_n and are 
calculated as follows: 


D_1 | D2 | ... | D_J = MSB_{J * n} (D), 


where D is the following constant in V (1024 


D = ( 80 81 82 83 84 85 86 87 
88 8 8a 8b 8c 8d 8e 8f 
90 91 92 93 94 95 96 97 
98 99 9a 9b 9c 9d 9e 9f 
a0 al a2 a3 a4 a5 a6 a7 
a8 a9 aa ab ac ad ae af 
b0 b1 b2 b3 b4 b5 b6 b7 
b8 b9 ba bb be bd be bf 
co c1 c2 C3 c4 C5 c6 c7 
c8 c9 ca cb CE cd ce cf 
d0 dl d2 d3 d4 d5 d6 d7 
d8 d9 da db dc dd de df 
e0 el e2 e3 e4 e5 e6 e7 
e8 e9 ea eb ec ed ee ef 
£0 fl £2 £3 £4 £5 £6 £7 


£8 £9 fa fb fc fd fe ff) 


Note: The constant D is such that D 1, ... , D_J are pairwise 
different for any allowed n and k values. 


Note: The highest bit of each octet of the constant D is equal to 1. 
This condition is important as, in conjunction with a certain mode 
message length limitation, it allows prevention of collisions of 
block cipher permutation inputs in cases with key transformation and 
message processing (for more details, see Section 4.4 of [AAOS2017]). 
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6.2.2. CTR-ACPKM Encryption Mode 


This section defines a CTR-ACPKM encryption mode that uses the ACPKM 
internal re-keying mechanism for the periodical key transformation. 


The CTR-ACPKM mode can be considered as the base encryption mode CTR 
(see [MODES]) extended by the ACPKM re-keying mechanism. 


The CTR-ACPKM encryption mode can be used with the following 


parameters 


o 64 <=n <= 512. 


o 128 <= k <= 512. 


o The number c of bits in a specific part of the block to be 
incremented is such that 32 <= c <= 3 / 4 n, where c is a multiple 


of 8. 


o The maximum message size m_max =n * 2%{c-1}. 


The CTR-ACPKM mode encryption and decryption procedures are defined 


as follows 


4+---------------------------------------------------------------- + 
CTR-ACPKM-Encrypt (N, K, ICN, P) 
Input: 
— section size N, 
- initial key K, 
— initial counter nonce ICN in V_{n-c}, 
— plaintext P = P_1 Soave | P b, | P | <= m_max. 
Output: 
- ciphertext C. 
1. CTR_1 = ICN | 0^c 
Zy For J = Zip 3y Sire Dodë 
CTR_{j} = Inc_c(CTR_{j-1}) 
Sy Kk. BK 
4. For i = 2; 3; «s y ceri PI / N) 
K*i = ACPKM(K^{i-1}) 
5e For J Vy -2p eS e Dado 
i = ceil(j * n/N), 
G_j = E_{K^i} (CTR J) 
6. C = P _ (xor) MSB_{|P|}(G_1 | ... | Gb) 
7. Return C 
4+---------------------------------------------------------------- + 
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Input: 

— section size N, 

— initial key K, 

— initial counter nonce ICN in V_{n-c}, 
ciphertext C = C_l sa Cab hell; mara 
Output : 

- plaintext P. 


2. Return P 


The initial counter nonce (ICN) value for each message that is 
encrypted under the given initial key K must be chosen in a unique 
manner. 


6.2.3. GCM-ACPKM Authenticated Encryption Mode 
This section defines the GCM-ACPKM authenticated encryption mode that 
uses the ACPKM internal re-keying mechanism for the periodical key 
transformation. 
The GCM-ACPKM mode can be considered as the base authenticated 
encryption mode GCM (see [GCM]) extended by the ACPKM re-keying 


mechanism. 


The GCM-ACPKM authenticated encryption mode can be used with the 
following parameters: 


o n in (128, 256}. 

o 128 <= k <= 512. 

o The number c of bits in a specific part of the block to be 
incremented is such that 1 / 4 n <= c <= 1 / 2 n, c is a multiple 
of 8. 


o Authentication tag length t. 


o The maximum message size m max = min{n * (2^{c-1} - 2), 2*{n/2} - 
1}. 
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The GCM-ACPKM mode encryption and decryption procedures are defined 


as follows: 


4+------------------------------------------------------------------- + 
GHASH (X, H) 
Input: 
- bit string X = X_1 | ate ds Xm, Kaly tek y KM a Veen. 
Output: 
— block GHASH(X, H) in V_n. 
1. Y 0 = 0”n 
2s BOR L Sy sede 2p Indo: 
Yi = (Y_{i-1} (xor) X_i) * H 
3. Return Y_m 
4+------------------------------------------------------------------- + 
4+------------------------------------------------------------------- + 
GCTR(N, K, ICB, X) 
Input: 
— section size N, 
- initial key K, 
— initial counter block ICB, 
-Xx=xX1 |... | Xb. 
Output: 
- Y in v{|x]}. 
1. If X in V 0, then return Y, where Y in V 0 
2. GCTR_1 = ICB 
35 FOP i -= Dp aen D do 
GCTR_i = Inc_c(GCTR_{i-1}) 
4. K1 = K 
5 Mer re By. 4 , ceil(|x| / N) 
K^j = ACPKM(K*{j-1}) 
6. For i= 1, , b do 
j = ceil(i * n/N), 
Gi = E_{K_j} (GCTR_1i) 
7. Y =X (xor) MSB_{|x|}(c_1 | ... | Gb) 
8. Return Y 
4+------------------------------------------------------------------- + 
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Input: 


section size N, 

initial key K, 

initial counter nonce ICN in V_{n-c}, 
plaintext P = P 1 | N, | P_b, Ip | <= m_max, 
additional authenticated data A. 


Output: 


ciphertext C, 
authentication tag T. 


1. H = E_{K} (0%n) 

2. ICB_0 = ICN | 0^{c-1} | 1 

3. C = GCTR(N, K, Inc -c (ICB_0), P) 

4. u =n * ceil(|c| / n) Ic] 

v =n * ceil( a / n) - lal 
5. S = GHASH(A | 0*v | c | 0^u | Vec_{n/2}(|A|) | 
| Vec_ {n/2) ( leh) 

6. T = MSB_t (E_{K} (ICB 0) (xor) S) 

7. Return C | T 
4-------------------------------------- 5 55555555 55555555555 —— + 
4----------------------------------------- === === == === = = === === === + 


GCM-ACPKM-Decrypt (N, K, ICN, A, C, T) 


Input: 


section size N, 

initial key K, 

initial counter block ICN, 

additional authenticated data A, 

ciphertext C = C1 |... | cb, |c| <= m max, 
authentication tag T. 


Output: 


plaintext P or FAIL. 


August 2019 


1. H = E_{K}(0^n) 
2. ICB_0 = ICN | 0^{c-1} | 1 
3. P = GCTR(N, K, Inc_c(ICB_0), C) 
4. u =n * ceil(|C| / n) Ic] 

v=n* ceil(ļa| / n) - lal 
5. S = GHASH(A | 0*v | c | 0^u | Vec tn/2) (Jah) | 

| vec_{n/2}(|c| 
6. T’ = MSB_t(E_{K}(ICB_0O) (xor) S) 
7. If T = T’, then return P; else return FAIL 
+-------------------------------------------------- == - == == -------- + 
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The * operation on (pairs of) the 2^n possible blocks corresponds to 
the multiplication operation for the binary Galois (finite) field of 
2^n elements defined by the polynomial f as follows (analogous to 
[GCM]) : 


=] 
ll 
= 
N 
koe) 
Hh 
ll 


a®%128 + a*%7 + a%2 + al #1, 
n= 256: £ = a%256 + a%10 + a%5 + a%2 4+ 1. 
The initial counter nonce ICN value for each message that is 


encrypted under the given initial key K must be chosen in a unique 
manner. 


The key for computing values E (K)(ICB 0) and H is not updated and is 
equal to the initial key K. 


6.3. Constructions that Require a Master Key 


This section describes the block cipher modes that use the ACPKM- 
Master re-keying mechanism, which use the initial key K as a master 
key, so K is never used directly for data processing but is used for 
key derivation. 


6.3.1. ACPKM-Master Key Derivation from the Master Key 


This section defines periodical key transformation with a master key, 
which is called the ACPKM-Master re-keying mechanism. This mechanism 
can be applied to one of the base modes of operation (CTR, GCM, CBC, 
CFB, OMAC modes) for getting an extension that uses periodical key 
transformation with a master key. This extension can be considered 
as a new mode of operation. 


Additional parameters that define the functioning of modes of 
operation that use the ACPKM-Master re-keying mechanism are the 
section size N, the change frequency T* of the master keys K“ 1, 
K*_2, ... (see Figure 10), and the size d of the section key 
material. The values of N and T* are measured in bits and are fixed 
within a specific protocol based on the requirements of the system 
capacity and the key lifetime. The section size N MUST be divisible 
by the block size n. The master key frequency T* MUST be divisible 
by d and by n. 
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The main idea behind internal re-keying with a master key is 
presented in Figure 10: 


Master key frequency T*, 
section size N, 


maximum message size = m_max. 
ACPKM ACPKM 
K*_1 = K---------- > KF 2 ---------...----- > K*_1 max 
nEaN (ee ae |e ae laa 
| | | | | | 
v v v v v v 
K[1] K[t] K[t+1] K[2*t] K[(l_max-1)t+1] K[l_max*t] 
| | | | | | 
| | | | | | 
v v v v v v 
Me as || | | KE | se | all 
M3 (2) | |====== Jin || [iste Lat elt | Era a 
St Jl | | | | | i} | | | SI 
M3 (aj | |====== Ba ES eat | sain Pe ] asa =f] 
section : 
K—————— » : 
N bit m max 
|K[il| =a, 
t = Tr / 4d, 
1 max = ceil(m max / (N * t)) 


Figure 10: Internal Re-keying with a Master Key 


During the processing of the input message M with the length m in 
some mode of operation that uses ACPKM-Master key transformation with 
the initial key K and the master key frequency T*, the message M is 


divided into 1 = ceil(m / N) sections (denoted as M- M1 | M2 | 

| M 1, where Mi is in V_N for i in {1, 2, , A1 - 1) and M1 
is in Vr, r <= N). The j-th section of each message is processed 
with the key material KIjl, j in {1, ... , 1}, |Kiil| = d, which is 


calculated with the ACPKM-Master algorithm as follows: 


K[1] | ... | K[1] = ACPKM-Master(T*, K, d, 1) = CTR-ACPKM-Encrypt 
(Te Ke Ln 2ye O0*(d* 1} h 


Note: The parameters d and 1 MUST be such that d * 1 <= n * 
2^{n/2-1}. 
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6.3.2. CTR-ACPKM-Master Encryption Mode 
This section defines a CTR-ACPKM-Master encryption mode that uses the 
ACPKM-Master internal re-keying mechanism for the periodical key 
transformation. 
The CTR-ACPKM-Master encryption mode can be considered as the base 
encryption mode CTR (see [MODES]) extended by the ACPKM-Master 


re-keying mechanism. 


The CTR-ACPKM-Master encryption mode can be used with the following 
parameters: 


o 64 <=n <= 512. 
o 128 <= k <= 512. 


o The number c of bits in a specific part of the block to be 
incremented is such that 32 <= c <= 3 / 4 n, c is a multiple of 8. 


o The maximum message size m_max = min{N * (n * 2%{n/2-1} / k), n * 
27°C} 


The key material K[j] that is used for one-section processing is 
equal to K*j, where |K*j| = k bits. 
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The CTR-ACPKM-Master mode encryption and decryption procedures are 
defined as follows: 


Input: 

— section size N, 

- initial key K, 

— master key frequency T*, 

— initial counter nonce ICN in V_{n-c}, 

—- plaintext P = P_l | isis | P b, Ip | <= m max. 
Output : 

- ciphertext C. 


: | 
Be BOL J S 25 Sy. Karan Bde 
CTR_{j} = Inc_c(CTR_{j-1}) 

3. 1 = ceil(|P| / N) 

4. K*1 | ... | K*1 = ACPKM-Master(T*, K, k, 1) 
Sa FOE J = Ly Ap mama podo 
= ceil(j * n/N), 
a= E_{K^i} (CTR_3) 
: (xor) MSB_{|P|}(G_1 | ... lab) 
7. Return C 


Input: 

— section size N, 

— initial key K, 

— master key frequency T*, 

— initial counter nonce ICN in V_{n-c}, 

- ciphertext C = C_1 |... | cb, |c| <= mmax. 
Output: 

— plaintext P. 

1. P = CTR-ACPKM-Master-Encrypt (N, K, T*, ICN, C) 
1. Return P 


The initial counter nonce ICN value for each message that is 
encrypted under the given initial key must be chosen in a unique 
manner. 
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6.3.3. GCM-ACPKM-Master Authenticated Encryption Mode 
This section defines a GCM-ACPKM-Master authenticated encryption mode 
that uses the ACPKM-Master internal re-keying mechanism for the 
periodical key transformation. 
The GCM-ACPKM-Master authenticated encryption mode can be considered 
as the base authenticated encryption mode GCM (see [GCM]) extended by 
the ACPKM-Master re-keying mechanism. 


The GCM-ACPKM-Master authenticated encryption mode can be used with 
the following parameters: 


o n in (128, 256}. 

o 128 <= k <= 512. 

o The number c of bits in a specific part of the block to be 
incremented is such that 1 / 4 n <= c <= 1 / 2 n, c is a multiple 
of 8. 


o authentication tag length t. 


o the maximum message size m_max = min{N * ( n * 2%{n/2-1} / k), n * 
(2”c - 2), 2%{n/2} - 1}. 


The key material K[j] that is used for the j-th section processing is 
equal to K^j, |K*3 | = k bits. 


The GCM-ACPKM-Master mode encryption and decryption procedures are 
defined as follows: 


4+------------------------------------------------------------------- + 
GHASH (X, H) 
Input: 
- bit string X = X1 | al Xm Ketan: Vn for a -in iy sia. Sm} 
Output: 


block GHASH (X, H) in V_n 


1. Y 0:5 0^n 
Zo For i = Tp ses op mdo 
Yi = (Y_{i-1} (xor) X i) * H 
3. Return Y m 
4+------------------------------------------------------------------- + 
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Y in 


Re-keying Mechanisms for Symmetric Keys 


— section size N, 

- initial key K, 

— master key frequency T*, 

— initial counter block ICB, 
-X=X 


L esal Ab 


Vo sel 


1 5 2, ... , bdo 
GCTR_i = Inc c(GCTR fi-1)) 


1. If X in V 0, then return Y, where Y in V 0 


August 2019 


4. 1 = ceil(|x| / N) 
5y KAL] | K^l = ACPKM-Master(T*, K, k, 1) 
6.6 FOL J Sly ass Ddo 
i = ceil(j * n/N), 
G_j = E_{K^i} (GCTR j) 
7. Y =X (xor) MSB_{|X|}(G_1 | | G_b) 
8. Return Y 
4+---------------------- SSS 5 355555555 + 
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Input: 

— section s 
— initial k 
—- master ke 
— initial c 
- plaintext 
— additiona 
Output : 

— ciphertex 
— authentic 


= AC 
E (K 
0 


ll 
5 
* 


= GHAS 


7. T = MSB- 
8. Return C 
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ize N, 

ey K, 

y frequency T*, 

ounter nonce ICN in V_{n-c}, 

P= P1 | | P b, | P | <= m_max. 
1 authenticated data A. 


t C, 
ation tag T. 


PKM-—-Master (T“, 
“1} (0%n) 
ICN | O*{c-1} | 
(N, K, T*, Inc_c 
ceil(|c| / n) 
ceil(|A| / n) - 
Ha | o^v |c] 
| vec_{n/2} (| 
t (E_{K*1} (ICB 0 
| T 


l 
— o ——— ar 


), H) 
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GCM-ACPKM-Master-Decrypt (N, K, Tx, ICN, A, C, T) 

Input: 

— section size N, 

- initial key K, 

— master key frequency T*, 

- initial counter nonce ICN in V_{n-c}, 

—- additional authenticated data A. 

- ciphertext C = C_1 |... | cb, |c| <= m max, 

- authentication tag T. 

Output: 

- plaintext P or FAIL. 

1. K^1 = ACPKM-Master(T*, K, k, 1) 

2. H = E_{K%1} (0%n) 

3. ICB 0 = ICN | 0^{c-1} | 1 

4. P = GCTR(N, K, T*, Inc c(ICB 0), C) 

5. u =n * ceil(|c| / n) - leci 

ven * ceil (|A| / n) - lal 
6. S = GHASH(A | 0^v | c | o^uùu | Vec_{n/2}(|A]) | 
| vec_{n/2}(|C]), E) 

7. T” = MSB_t (E_{K%1} (ICB 0) (xor) S) 

8. If T = T', then return P; else return FAIL. 
aa aa + 
The * operation on (pairs of) the 2^n possible blocks corresponds to 
the multiplication operation for the binary Galois (finite) field of 
2^n elements defined by the polynomial f as follows (by analogy with 

GCM]) : 
n= 128: f = a%128 + a^7 + a^2 ta + 1, 
n= 256: £ = a%256 + a%10 + a%5 + a%2 4+ 1. 
The initial counter nonce ICN value for each message that is 
encrypted under the given initial key must be chosen in a unique 
manner. 
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6.3.4. CBC-ACPKM-Master Encryption Mode 


This section defines a CBC-ACPKM-Master encryption mode that uses the 
ACPKM-Master internal re-keying mechanism for the periodical key 
transformation. 


The CBC-ACPKM-Master encryption mode can be considered as the base 
encryption mode CBC (see [MODES]) extended by the ACPKM-Master 
re-keying mechanism. 


The CBC-ACPKM-Master encryption mode can be used with the following 
parameters: 


o 64 <= n <= 512. 
o 128 <= k <= 512. 
o The maximum message size m_max = N * (n * 2%{n/2-1} / k). 


In the specification of the CBC-ACPKM-Master mode, the plaintext and 
ciphertext must be a sequence of one or more complete data blocks. 

If the data string to be encrypted does not initially satisfy this 
property, then it MUST be padded to form complete data blocks. The 
padding methods are out of the scope of this document. An example of 
a padding method can be found in Appendix A of [MODES]. 


The key material K[j] that is used for the j-th section processing is 
equal to K^j, |K*5| = k bits. 


We use D_{K} to denote the decryption function that is a permutation 
inverse to E_{K}. 


Smyshlyaev Informational [Page 37] 


RFC 8645 Re-keying Mechanisms for Symmetric Keys 


August 2019 


The CBC-ACPKM-Master mode encryption and decryption procedures are 


defined as follows: 


4+----------------------------- - - - - - - 5 5555 + 
CBC-ACPKM-Master-Encrypt (N, K, Tx, IV, P) 
Input: 
— section size N, 
- initial key K, 
— master key frequency T*, 
— initialization vector IV in V_n, 
—- plaintext P = P 1 | seeds | P b, |P_b| =n, Ip | <= m_max. 
Output: 
- ciphertext C. 
1. 1 = ceil(|P| / N) 
2. K^1 | ... | K^l = ACPKM-Master(T*, K, k, 1) 
3. C0 = IV 
4e FOE = 15.25. ea pe b do 
is=zeeilt(j * / N), 
C_j = E_{K*1i}(P_j (xor) C_{j-1}) 
5. Return C = C 1 | Kar | cb 
LL AE ma Sa am Ka Ta aa TN La II KA Ta TS Sa Ba Sa IS Ka ap Sa DN aa as Se TN aa II Ta + 
4+---------------------------- - - - - - - - 5 = + 
CBC-ACPKM-Master-Decrypt (N, K, Tx, IV, C) 
Input: 
— section size N, 
—- initial key K, 
— master key frequency T*, 
— initialization vector IV in V_n, 
= ciphertext C = C1 | ... | cb, |cb| =n, |c| Smee, 
Output: 
- plaintext P. 
1. 1 = ceil(|c| / N) 
2. K^1 | ... | K^l = ACPKM-Master(T*, K, k, 1) 
3. C0 = IV 
Ae For g= Up Ap «x y b do 
isoce II Gan DA / N) 
Pj = D_{K*i}(C_j) (xor) C_{j-1} 
5. Return P = P 1 | E | Pb 
ALL 555555 335555555555 = + 
The initialization vector IV for any particular execution of the 
encryption process must be unpredictable. 
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6.3.5. CFB-ACPKM-Master Encryption Mode 


This section defines a CFB-ACPKM-Master encryption mode that uses the 
ACPKM-Master internal re-keying mechanism for the periodical key 
transformation. 


The CFB-ACPKM-Master encryption mode can be considered as the base 
encryption mode CFB (see [MODES]) extended by the ACPKM-Master 
re-keying mechanism. 


The CFB-ACPKM-Master encryption mode can be used with the following 
parameters: 


o 64 <= n <= 512. 
o 128 <= k <= 512. 
o The maximum message size m_max = N * (n * 2%{n/2-1} / k). 


The key material K[j] that is used for the j-th section processing is 
equal to K^j, |K*3 | = k bits. 


The CFB-ACPKM-Master mode encryption and decryption procedures are 
defined as follows: 


Input: 

— section size N, 

- initial key K, 

— master key frequency T*, 

— initialization vector IV in V_n, 

— plaintext P = P_1 | AR | P b, | P | <= m_max. 
Output: 

- ciphertext C. 


1. 1 = ceil(|P| / N) 
2. K*1 | ... | K^l = ACPKM-Master(T*, K, k, 1) 
3a; LO Ss IN 
4. For J Tea Dian Std ge Bye AL do 
i = ceil(j * n/N), 
C_j = E_{K*i}(C_{j-1}) (xor) Pj 
5. Cb = MSB_{|P_b|} (E_{K*1}(C_{b-1})) (xor) Pb 
6.2 Return S Cat Way Gab 
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Input: 

— section size N, 

—- initial key K, 

— master key frequency T*, 

— initialization vector IV in V_n, 

- ciphertext C = C_1 |... | cb, |c| <= m max. 
Output: 

- plaintext P. 


1. 1 = ceil(|c| / N) 
2. K^1 | ... | K^l = ACPKM-Master(T*, K, k, 1) 
PA SIN OA 
4. Por jg = Ip 25. see 4. b= 1. do 
i = ceil(j * n/N), 
Pj = E_{K*i}(C_{j-1}) (xor) C_j 
5. Pb = MSB_{|C_b|} (E_{K*1} (C_{b-1})) (xor) Cb 
6. Return Pre Pid |... | Pp 
+------------------------ 555555555 5555555553 + 


The initialization vector IV for any particular execution of the 
encryption process must be unpredictable. 


6.3.6. OMAC-ACPKM-Master Authentication Mode 


This section defines an OMAC-ACPKM-Master message authentication code 
calculation mode that uses the ACPKM-Master internal re-keying 
mechanism for the periodical key transformation. 


The OMAC-ACPKM-Master mode can be considered as the base message 
authentication code calculation mode OMAC1, which is also known as 
CMAC (see [RFC4493]), extended by the ACPKM-Master re-keying 
mechanism. 


The OMAC-ACPKM-Master message authentication code calculation mode 
can be used with the following parameters: 


o nin (64, 128, 256}. 
o 128 <= k <= 512. 
o The maximum message size m_max = N * (n * 2%{n/2-1} / (k + n)). 


The key material K[j] that is used for one-section processing is 
equal to K“j | K*j_1, where |K*3| = k bits and [Rage 1 | =n bits. 
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The following is a specification of the subkey generation process of 


OMAC : 
KR RAR AT TE LARAS EA RARE RE PAR + 
Generate Subkey (Kl, r) 
Input: 
— key Kl 
Output 
= key SK 
1. If r =n, then return K1 
2. If r « n, then 
if MSB_1 (K1) = 0 
return K1 << 1 
else 
return (K1 << 1) (xor) Rn 
HHS Seo SSS Sa See SSeS Se SSS SSeS SSS SS SS Se eee SS + 
Here, R_n takes the following values: 
o n= 64: R_{64} = 0*{59} | 11011. 
o n= 128: R (128) = 0*{120} | 10000111. 
o n = 256: R (256) = 0%{145} | 10000100101. 
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authentication code calculation mode is 


4+----------------------------- - - - - - - 5 553555555553 + 

OMAC-ACPKM-Master (K, N, T*, M) 

Input : 

— section size N, 

- initial key K, 

— master key frequency T*, 

—- plaintext M = M1 | | M b, Im| <= m max. 

Output : 

- message authentication code T. 

1. C0 = 0^n 

2. 1 = ceil(|M| / N) 

3 KAT | RAG | | K^l1 | K^l1 = 

= ACPKM-Master(T*, K, (k + n), 1) 
4 For ji Sp 25) dhe dg Beery 1 -do. 
i = ceil(j * n/N), 
C_j = E_{K*i}(M_j (xor) C_{j-1}) 
5. SK = Generate_Subkey(K*1_1, |M_b]) 
6. If |Mb| =n, then M*_b = Mb 
else M*_b=Mb | 1 | 0%{n - 1 -|Mb|} 

7. T = E_{K*1} (M*_b (xor) C_{b-1} (xor) SK) 

8. Return T 

4+----------------------------- - - - - - - 5 5 = + 
7. Joint Usage of External and Internal Re-keying 


Both external re-keying and internal re-keying have their own 


advantages and disadvantages, 
instance, 
length, 


which are discussed in Section 1. 
using external re-keying can essentially limit the message 
while in the case of internal re-keying, 


For 


the section size, 


which can be chosen as the maximal possible for operational 


properties, 
choice of re-keying mechanism 
on particular protocol features. 


limits the number of separat 
(either external or internal) 
However, 


the 
depends 
some protocols may have 


messages. Therefore, 


features that require the advantages of both the external and 


internal re-keying mechanisms: 
transmits short messages, 


for example, 
but it must additionally support processing 


the protocol mainly 


of very long messages. 
external and internal re-keying jointly, 


In such situations, 


it is necessary to use 
since these techniques 


negate each other’s disadvantages. 


For composition of external and internal re-keying techniques, 


any 


mechanism described in Section 5 can be used with any mechanism 


described in Section 6. 
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For example, consider the GCM-ACPKM mode with external serial 
re-keying based on a KDF on a hash function. Denote the number of 
messages in each frame (in the case of the implicit approach to the 
key lifetime control) for external re-keying as a frame size. 


Let L be a key lifetime limitation. The section size N for internal 
re-keying and the frame size q for external re-keying must be chosen 
in such a way that q * N must not exceed L. 


Suppose that t messages (ICN_i, P_i, A_i), with initial counter nonce 


ICN_i, plaintext P_i, and additional authenticated data A_i will be 
processed before renegotiation. 


For authenticated encryption of each message (ICN_i, P_i, A_i), i = 
1, ..., t, the following algorithm can be applied: 

1. j = ceil(i / q), 

2. K^j = ExtSerialH(K, j), 

3. Ci | Ti = GCM-ACPKM-Encrypt (N, K*j, ICN_i, P_i, Ai). 

Note that nonces ICN i that are used under the same frame key must be 


unigue for each message. 
Security Considerations 


Re-keying should be used to increase a priori security properties of 
ciphers in hostile environments (e.g., with side-channel 
adversaries). If efficient attacks on a cipher are known, the cipher 
must not be used. Thus, re-keying cannot be used as a patch for 
vulnerable ciphers. Base cipher properties must be well analyzed 
because the security of re-keying mechanisms is based on the security 
of a block cipher as a pseudorandom function. 


Re-keying is not intended to solve any postquantum security issues 
for symmetric cryptography, since the reduction of security caused by 
Grover’s algorithm is not connected with a size of plaintext 
transformed by a cipher -- only a negligible (sufficient for key 
uniqueness) material is needed -- and the aim of re-keying is to 
limit the size of plaintext transformed under one initial key. 


Re-keying can provide backward security only if previous key material 
is securely deleted after usage by all parties. 


IANA Considerations 


This document has no IANA actions. 
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A.1. Test Examples for External Re-keying 


A.1.1. 


A. 


External Re-keying with a Parallel Construction 
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Test Examples 


August 2019 


External re-keying with a parallel construction based on AES-256 
KKEKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKEKKKKKKKKKKKKKKKKKKKKKKKKKKKK 


k = 2 
t= 1 


Initial key: 


56 
28 


00 01 02 03 
OF OE OD OC 


K*1: 
51 16 
64 7D 


K*2: 
6F ED 
B8 02 


K3: 
B6 40 
5B F3 


8A 
5C 


F5 
92 


24 
30 


K^126: 


2F 3F 
23 E4 


15 
1C 


K*127: 


8E 51 
97 43 


31 
15 


K*128: 


77 4F 
94 49 


BF 
AF 


B6 
D5 


D3 
32 


85 


3D 


1B 


4E 


FB 
10 


B3 
84 


04 
OB 


C8 
LE 


FT 
D8 


A4 


3B 


53 


46 


OB 
6C 


22 
2D 


05 
OA 


A8 
3D 


57 
D3 


24 


20 


88 


FF 


64 
AF 


60 
84 


06 
09 


38 
62 


48 
8D 


BD 


EB 


23 


6B 


BB 
5D 


C5 
65 


07 
08 


65 
98 


75 
73 


35 


14 


CD 


33 


DO 
5E 


3B 
A7 


08 
07 


54 
BC 


35 
FE 


B4 


D1 


7D 


34 


BC 
41 


A3 
F4 


09 
06 


85 
09 


2B 
DC 


26 


3B 


03 


12 


D4 
EO 


8E 
F7 


OA 
05 


31 
Bl 


oF 
DD 


43 


B7 


FẸ 


27 


CS 
17 


FE 
2C 


OB 
04 


A5 
D8 


4D 
c6 


13 


91 


3D 


84 


7B 
F4 


B1 
DC 


OC 
03 


D2 
64 


B6 
C8 


76 


74 


FD 


EF 


1c 
05 


96 
A4 


OD 
02 


BA 
EC 


5B 
36 


26 


E3 


B3 


5D 


66 
63 


46 
9D 


OF 
01 


C3 
D9 


EO 
78 


70 


DB 


57 


82 


EF 
05 


76 
84 


OF 
00 


86 
Bl 


15 
BD 


B6 


EC 


5E 


23 


FD 
ED 


41 
F9 


External re-keying with a parallel construction based on SHA-256 
kkkxkxkxkxkxkxkxkkxkxkxkkxkkkxkxkxkxkxkxkkxkxkxkkxkkkxkxkkkxkkkxkxkkkxkxkkxkxkkkxkxkkxkxkkkxkkkkxkxkx*k 


k = 2 
t= 1 


56 
28 


label: 


SHA2label 


Smyshlya 


ev 


Informational 


[Page 48] 


RFC 8645 


Initial key: 


00 01 02 03 
OF OE OD OC 


K*%1: 
C1 Al 
26 TA 


K*2: 
03 68 
A9 B8 


K3 
2F D3 
OA C3 


4C 
CD 


BB 
A9 


68 
14 


K*126: 


55 AC 
C8 04 


2B 
E9 


K*127: 


77 4D 
6C 23 


1S 
EL 


K^128: 


E5 81 
94 C3 


A.1.2. 


FF 
42 


External Re-keying 


A0 
5A 


74 
5F 


D3 


1D 


25 


D3 


88 
B3 


FB 
06 


04 
OB 


30 
E8 


41 
OE 


A7 


80 


00 


B6 


BO 
91 


OC 
41 


Re-keying 


05 
OA 


29 
7D 


2A 
DC 


8F 


26 


78 


08 


40 
Bl 


90 


06 
09 


BE 
E7 


98 
3C 


91 


3E 


3E 


7D 


90 
EF 


88 


07 
08 


43 
D1 


ED 
TE 


E6 


61 


D4 


co 


ES 
DF 


CD 


AB Cl 72 


Mechanisms for 


08 
07 


9F 
B2 


C4 
3B 


3B 


C9 


34 


70 


8C 
E5 


E5 
66 


with a Serial Construction 


09 
06 


35 
E2 


7B 
D2 


68 


OD 


2B 


2A 


6A 
77 


F4 
CC 


OA 
05 


3C 
C7 


94 
59 


DC 


24 


65 


99 


D7 
64 


A5 
2F 


OB 
04 


79 
AF 


CC 
4D 


2B 


45 


OE 


A4 


5D 
CD 


57 
59 


OC 
03 


1A 
A4 


DF 
D1 


41 


2A 


75 


B5 


OF 
09 


B6 
74 


Symmetric Keys 


OD 
02 


51 
29 


9C 
75 


1D 


BD 


E5 


85 


CF 
F5 


AB 
9C 


OF 
01 


48 
BD 


F4 
82 


AC 


B1 


8B 


EL 


OA 
BC 


D2 
86 


OF 
00 


57 
35 


9E 
D4 


80 


AE 


76 


A1 


4A 
AF 


2E 
B3 
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External re-keying with a serial construction based on AES-256 
kkkxkxkxkxkkxkxkkxkxkxkxkxkxkkxkxkxkkxkxkkxkxkkkxkxkkxkxkxkkxkxkkxkxkkkxkxkkxkxkxkkxkxkxkkxkkkxkxkkxk*kxxk 


AES 256 examples: 


k= 2 
t= 1 


Initial key: 


56 
28 


00 01 02 03 04 
OF OE OD OC OB 


K*_1: 


00 01 02 03 04 
OF OE OD OC OB 


Smyshlya 


ev 


05 06 07 
OA 09 08 


05 06 07 
OA 09 08 


08 
07 


08 
07 


09 OA OB 
06 05 04 


09 OA OB 
06 05 04 


OC 
03 


OC 
03 


OD 
02 


OD 
02 
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01 


OF 
01 


OF 
00 


OF 
00 
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K*1: 
66 B8 
51 16 


KA 2% 
64 7D 
6F ED 


K*2: 
66 B8 
51 16 


K*_3: 
64 7D 
6F ED 


K*3: 
66 B8 
51 16 


BD 
8A 


5C 
F5 


BD 
8A 


5C 
F5 


BD 
8A 


K*_126: 


64 7D 
6F ED 


K*126: 


66 B8 
51 16 


SC 
F5 


BD 
8A 


Ks 127: 


64 7D 
6F ED 


K*127: 


66 B8 
51 16 


9C 
F5 


BD 
8A 


K“ 128: 


64 7D 
6F ED 


K*128: 


66 B8 
51 16 


SC 
F5 


BD 
8A 


Smyshlyaev 


E5 
B6 


D5 
D3 


E5 
B6 


D5 
D3 


E5 


B6 


D5 


D3 


E5 
B6 


D5 
D3 


E5 
B6 


D5 
D3 


E5 
B6 


90 
C8 


1c 
77 


90 
C8 


re 
77 


90 


C8 


EG 


77 


90 
C8 


1C 
77 


90 
C8 


IC 
Tl 


90 
C8 


Re-keying 


6C 
A8 


3D 
57 


6C 
A8 


3D 
57 


6C 


A8 


3D 


57 


6C 
A8 


3D 
57 


6C 
A8 


3D 
57 


6C 
A8 


EC 
38 


62 
48 


EC 
38 


62 
48 


EC 


38 


62 


48 


EC 
38 


62 
48 


EC 
38 


62 
48 


EC 
38 


DF 
65 


98 
75 


DF 
65 


98 
75 


DF 


65 


98 


75 


DF 
65 


98 
75 


DF 
65 


98 
75 


DF 
65 


Mechanisms for 


FA 
54 


BC 
35 


FA 
54 


BC 
35 


FA 


54 


BC 


35 


FA 
54 


BC 
35 


FA 
54 


BC 
35 


FA 
54 


8A 
85 


09 
2B 


8A 
85 


09 
2B 


8A 


85 


09 


2B 


8A 
85 


09 
2B 


8A 
85 


09 
2B 


8A 
85 


B2 
31 


Bl 
SF 


B2 
31 


B1 
5F 


B2 


31 


B1 


SF 


B2 
31 


Bl 
SF 


B2 
31 


B1 
SF 


B2 
31 


FD 
A5 


D8 
4D 


FD 
A5 


D8 
4D 


FD 


A5 


D8 


4D 


FD 
A5 


D8 
4D 


FD 
A5 


D8 
4D 


FD 
A5 


92 
D2 


64 
B6 


92 
D2 


64 
B6 


92 


D2 


64 


B6 


92 
D2 


64 
B6 


92 
D2 


64 
B6 


92 
D2 


Symmetric Keys 


84 
BA 


EC 
5B 


84 
BA 


EC 
5B 


84 


BA 


EC 


5B 


84 
BA 


EC 
5B 


84 
BA 


EC 
5B 


84 
BA 


Informational 


EB 
C3 


D9 
EO 


EB 
C3 


D9 
EO 


EB 


c3 


D9 


EO 


EB 
C3 


D9 
EO 


EB 
C3 


D9 
EO 


EB 
c3 


FO 
86 


B1 
E5 


FO 
86 


B1 
15 


FO 


86 


B1 


15 


FO 
86 


Bl 
15 


FO 
86 


B1 
15 


FO 
86 
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External re-keying with a serial construction based on SHA-256 
KEKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKEKK 


k = 256 
t = 128 


Initial key: 


00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF 
OF OE OD OC OB OA 09 08 07 06 05 04 03 02 01 00 


labell: 


SHA2 label 


Smyshlyaev 


02 
C3 


22 
65 


04 
OB 


6C 
ED 


TC 
E3 


2B 
FE 


D2 
DF 


AE 


A8 


AA 


B3 


DC 
2C 


05 
OA 


FD 
70 


19 
CC 


EF 
01 


45 
BO 


BC 


B9 


OB 


2F 


40 
CE 


06 
09 


52 
4F 


86 
40 


B8 
11 


El 
5D 


D1 


48 


42 


DD 


48 
4A 


07 
08 


TE 
B5 


24 
6D 


89 
99 


93 
67 


C8 


29 


4A 


EF 


OF 
76 


08 
07 


F7 
FB 


9B 
A9 


42 
1D 


69 
CD 


24 


87 


F2 


E4 


29 
2C 


09 
06 


36 
10 


D3 
48 


54 
FB 


53 
1B 


04 


37 


CO 


92 


C3 
FE 


OA 
05 


A4 
33 


56 
DA 


1B 
98 


40 
BF 


BF 


El 


46 


79 


90 
2A 


OB 
04 


E2 
CC 


DF 
SC 


8C 
15 


55 
96 


F6 


BA 


52 


5D 


B8 
42 


OC 
03 


81 
EC 


CE 
DO 


1B 
FE 


43 
37 


D7 


E7 


68 


BB 


ES 
C8 


OD 
02 


c6 
EE 


BE 
68 


3F 
65 


70 
D3 


Bl 


8F 


8B 


45 


D7 
5B 


Informational 


OF 
01 


OA 
D5 


73 
8A 


8D 
85 


95 
E3 


AC 


Br 


CI 


OB 


AT 
FE 


OF 
00 


9B 
EC 


6F 
04 


B1 
CF 


8D 
EB 


BF 


92 


E6 


CA 


34 
9A 
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Kee VOT: 
84 5F 49 
05 A7 07 


K*127: 
57 FO BD 
FO EE EF 


K*_128: 
52 F2 OF 
TA A6 04 


K*128: 
9B DD 24 


3D 
37 


5A 
E1 


56 
86 


7D 


B8 
BA 


B8 
50 


5E 
35 


F3 


C1 6D 2D 2B 4F 


Re-keying 


13 
15 


2A 
74 


9C 
16 


25 
3F 


1D 
72 


F3 
E5 


56 
BA 


AA 
TE: 


39 
EO 


6B 
BA 


84 
98 


15 
2B 


Mechanisms for 


36 
73 


87 
13 


AF 
E4 


EO 
5E 


2B 
49 


33 
Gi 


69 
CB 


22 
99 


A.2. Test Examples for Internal 


A.2.1. 


CTR-ACPKM mode with AES-256 


KKKEKKKKKKKKKKKKKKKKKKKKKKKK 


k = 256 
n = 128 
c = 64 

N = 256 


Initial key K: 


00000: 
00010: 


Plaintext P: 


00000: 
00010: 
00020: 
00030: 
00040: 
00050: 
00060: 


ICN: 
12 34 56 
23 34 45 


Dals 
00000: 


Smyshlyaev 


88 
FE 


11 
00 
11 
22 
33 
44 
55 


78 
56 


80 


99 
DC 


22 
11 
22 
33 
44 
55 
66 


90 
67 


81 


AA 
BA 


33 
22 
33 
44 
55 
66 
77 


AB 
78 


82 


BB 
98 


44 
33 
44 
55 
66 
TY 
88 


CE 
89 


83 


CC 
76 


55 
44 
55 
66 
77 
88 
99 


FO 
90 


84 


DD 
54 


66 
55 
66 
77 
88 
99 
AA 


Al 
12 


85 


EE 
32 


77 
66 
77 
88 
99 
AA 
BB 


B2 
13 


86 


BE 
C2 


CF 
23 


AD 
46 


68 
82 


Re-keying 


FF 
10 


00 
77 
88 
99 
AA 
BB 
CC 


C3 
14 


87 


D3 
67 


F7 
68 


45 
D2 


25 
TF 


00 
01 


FF 
88 
99 
AA 
BB 
CC 
EE 


D4 
15 


88 


74 
5D 


22 
87 


EE 
E8 


68 
15 


11 
23 


EE 
99 
AA 
BB 
CC 
EE 
EF 


E5 
16 


89 


Symmetric Keys 


8F 
OA 


62 
36 


B8 
9A 


DA 
Al 


22 
45 


DD 
AA 
BB 
CC 
EE 
FF 
OA 


FO 
17 


8A 


Informational 


80 
28 


B4 
29 


DA 
C1 


9D 
AF 


33 
67 


CC 
BB 
CC 
EE 
FF 
OA 
00 


01 
18 


8B 


A1 
Al 


DO 
A2 


4E 
09 


D5 
A4 


44 
89 


BB 
CC 
EE 
FF 
OA 
00 
11 


12 
19 


8c 


55 
AB 


AA 
EE 
FF 
OA 
00 
11 
22 


8D 


66 
CD 


99 
FF 
OA 
00 
11 
22 
33 


8E 


77 
EF 


88 
OA 
00 
11 
22 
33 
44 


8F 
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D_2: 
00000: 90 91 92 93 94 95 96 97 98 99 9A 9B 9C 9D 9E YF 
Section 1 
Section key K“1: 
00000: 88 99 AA BB CC DD EE FF 00 11 22 33 44 55 66 77 
00010: FE DC BA 98 76 54 32 10 01 23 45 67 89 AB CD EF 


Input block CTR 1: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 00 


Output block G 1: 
00000: FD 7E F8 9A D9 7E A4 B8 8D B8 B5 1C 1C 9D 6D DO 


Input block CTR 2: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 O1 


Output block G 2: 
00000: 19 98 C5 71 76 37 FB 17 11 E4 48 FO OC OD 60 B2 


Section 2 

Section key K“2: 

00000: F6 80 D1 21 2F A4 3D F4 EC 3A 91 DE 2A B1 6F 1B 
00010: 36 BO 48 8A 4F Cl 2E 09 98 D2 E4 A8 88 E8 4F 3D 


Input block CTR 3: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 02 


Output block G 3: 
00000: E4 88 89 4F B6 02 87 DB 77 5A 07 D9 2C 89 46 EA 


Input block CTR 4: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 03 


Output block G 4: 
00000: BC 4F 87 23 DB FO 91 50 DD B4 06 C3 1D A9 7C A4 


Section 3 

Section key K“3: 

00000: 8E B9 7E 43 27 1A 42 F1 CA 8E E2 5F 5C C7 C8 3B 
00010: 1A CE 9E 5E DO 6A A5 3B 57 B9 6A CF 36 5D 24 B8 


Input block CTR_5: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 04 
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Output block G 5: 
00000: 68 6F 22 7D 8F B2 9C BD 05 C8 C3 7D 22 FE 3B B7 


Input block CTR 6: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 05 


Output block G 6: 
00000: CO 1B F9 7F 75 6E 12 2F 80 59 55 BD DE 2D 45 87 


Section 4 

Section key K“4: 

00000: C5 71 6C C9 67 98 BC 2D 4A 17 87 B7 8A DF 94 AC 
00010: F8 16 F8 0B DB BC AD 7D 60 78 12 9C OC B4 02 F5 


Block number 7: 


Input block CTR_7: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 06 


Output block G 1: 
00000: 03 DE 34 74 AB 9B 65 8A 3B 54 1E F8 BD 2B F4 7D 


The result G=G_1|G2]|63 |G4]|cG5 |G6| e67: 


00000: FD 7E F8 9A D9 7E A4 B8 8D B8 B5 1C 1C 9D 6D DO 
00010: 19 98 C5 71 76 37 FB 17 11 E4 48 FO OC OD 60 B2 
00020: E4 88 89 4F B6 02 87 DB 77 5A 07 DY 2C 89 46 EA 
00030: BC 4F 87 23 DB FO 91 50 DD B4 06 C3 1D A9 7C A4 
00040: 68 6F 22 7D 8F B2 9C BD 05 C8 C3 7D 22 FE 3B B7 
00050: CO 1B F9 7F 75 6E 12 2F 80 59 55 BD DE 2D 45 87 
00060: 03 DE 34 74 AB 9B 65 8A 3B 54 1E F8 BD 2B F4 7D 


The result ciphertext C = P (xor) MSB_{|P|}(G): 


00000: EC 5C CB DE 8C 18 D3 B8 72 56 68 DO A7 37 F4 58 
00010: 19 89 E7 42 32 62 9D 60 99 7D E2 4B CO E3 9F B8 
00020: F5 AA BA OB E3 64 FO 53 EE FO BC 15 C2 76 4C EA 
00030: 9E 7C C3 76 BD 87 19 C9 77 OF CA 2D E2 A3 7C B5 
00040: 5B 2B 77 1B F8 3A 05 17 BE 04 2D 82 28 FE 2A 95 
00050: 84 4E 9F 08 FD F7 B8 94 4C B7 AA B7 DE 3C 67 B4 
00060: 56 B8 43 FC 32 31 DE 46 D5 AB 14 F8 AC 09 C7 39 
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GCM-ACPKM mode with AES-128 


KKKEKKKKKKKKKKKKKKKKKKKKKKKK 


k = 128 
n = 128 
c = 32 

N = 256 


Initial key K: 
00000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 


Additional data A: 
00000: 11 22 33 


Plaintext: 

00000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 


ICN: 
00000: 00 00 00 00 00 00 00 00 00 00 00 00 


Number of sections: 2 


Section key K“1: 
00000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 


Section key K“2: 
00000: 15 1A 9F BO B6 AC C5 97 6A FB 50 31 D1 DE C8 41 


Encrypted GCTR 1 | GCTR 2 | GCTR 3: 
00000: 03 88 DA CE 60 B6 A3 92 F3 28 C2 B9 71 B2 FE 78 


00010: F7 95 AA AB 49 4B 59 23 F7 FD 89 FF 94 8B C1 EO 
00020: D6 B3 12 46 E9 CE 9F F1 3A B3 42 7E E8 91 96 AD 


Ciphertext C: 


00000: 03 88 DA CE 60 B6 A3 92 F3 28 C2 B9 71 B2 FE 78 
00010: F7 95 AA AB 49 4B 59 23 F7 FD 89 FF 94 8B Cl EO 
00020: D6 B3 12 46 E9 CE 9F F1 3A B3 42 7E E8 91 96 AD 


GHASH input: 


00000: 11 22 33 00 00 00 00 00 00 00 00 00 00 00 00 00 
00010: 03 88 DA CE 60 B6 A3 92 F3 28 C2 B9 71 B2 FE 78 
00020: F7 95 AA AB 49 4B 59 23 F7 FD 89 FF 94 8B Cl EO 
00030: D6 B3 12 46 E9 CE 9F F1 3A B3 42 7E E8 91 96 AD 
00040: 00 00 00 00 00 00 00 18 00 00 00 00 00 00 01 80 


GHASH output S: 
00000: E8 ED E9 94 9A DD 55 30 BO F4 4E F5 00 FC 3E 3C 
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2 


Authentication tag T: 


Re-keying Mechanisms for 


Symmetric Keys 


00000: BO OF 15 5A 60 A3 65 51 86 8B 53 

The result C | Ts 

00000: 03 88 DA CE 60 B6 A3 92 F3 28 C2 

00010: F7 95 AA AB 49 4B 59 23 F7 FD 89 

00020: D6 B3 12 46 E9 CE 9F F1 3A B3 42 

00030: BO OF 15 5A 60 A3 65 51 86 8B 53 

.2. Internal Re-keying Mechanisms with a 

CTR-ACPKM-Master mode with AES-256 

KEKKEKEEEKEEKEEKEKEEKEEEEKEKEKEKEKEKEKEEEKEKEKEKKKAKK 

k = 256 

n = 128 

c for CTR-ACPKM mode = 64 

c for CTR-ACPKM-Master mode = 64 

N = 256 

Tx = 512 

Initial key K: 

00000: 88 99 AA BB CC DD EE FF 00 11 22 

00010: FE DC BA 98 76 54 32 10 01 23 45 

Initial vector ICN: 

00000: 12 34 56 78 90 AB CE FO Al B2 C3 

Plaintext P: 

00000: 11 22 33 44 55 66 77 00 FF EE DD 

00010: 00 11 22 33 44 55 66 77 88 99 AA 

00020: 11 22 33 44 55 66 77 88 99 AA BB 

00030: 22 33 44 55 66 77 88 99 AA BB CC 

00040: 33 44 55 66 77 88 99 AA BB CC EE 

00050: 44 55 66 77 88 99 AA BB CC EE FF 

00060: 55 66 77 88 99 AA BB CC EE FF OA 

BOL | K^2 | K^3 | K^4: 

00000: 9F 10 BB F1 3A 79 FB BD 4A 4C A8 

00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 

00020: 77 91 17 50 EO D1 77 E5 9A 13 78 

00030: AB 6B 59 EE 92 49 05 B3 AB C7 A4 

00040: E8 76 2B 30 8B 08 EB CE 3E 93 9A 

00050: 60 9A AB D9 15 33 13 D3 CF D3 94 

00060: F2 EE 91 45 6B DC 3D E4 91 2C 87 

00070: 2F 20 2E 5A C4 9A 2A 65 31 33 D6 
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Section_1 

K^1: 

00000: 9F 10 BB F1 3A 79 FB BD 4A 4C A8 64 C4 90 74 64 
00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 A4 79 28 3C 60 


Input block CTR 1: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 00 


Output block G 1: 
00000: 8C A2 B6 82 AT 50 65 3F 8E BF 08 E7 9F 99 4D 5C 


Input block CTR 2: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 01 


Output block GCG 2: 
00000: F6 A6 A5 BA 58 14 1E ED 23 DC 31 68 D2 35 89 Al 


Section 2 


K*2: 
00000: 77 91 17 50 EO D1 77 E5 9A 13 78 2B F1 89 08 DO 
00010: AB 6B 59 EE 92 49 05 B3 AB C7 A4 E3 69 65 76 C3 


Input block CTR_3: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 02 


Output block G_3: 
00000: 4A 07 5F 86 05 87 72 94 1D 8E 7D F8 32 F4 23 71 


Input block CTR 4: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 03 


Output block G 4: 
00000: 23 35 66 AF 61 DD FE A7 B1 68 3F BA BO 52 4A D7 


Section_3 


K*3: 
00000: E8 76 2B 30 8B 08 EB CE 3E 93 9A C2 CO 3E 76 D4 
00010: 60 9A AB D9 15 33 13 D3 CF D3 94 E7 75 DF 3A 94 


Input block CTR_5: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 04 
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Output block G 5: 
00000: A8 09 6D BC E8 BB 52 FC DE 6E 03 70 C1 66 95 E8 


Input block CTR 6: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 05 


Output block G 6: 
00000: C6 E3 6E 8E 5B 82 AA C4 A6 6C 14 8D B1 F6 9B EF 


Section 4 


K4: 
00000: F2 EE 91 45 6B DC 3D E4 91 2C 87 C3 29 CF 31 A9 
00010: 2F 20 2E 5A C4 9A 2A 65 31 33 D6 74 8C 4F F9 12 


Input block CTR_7: 
00000: 12 34 56 78 90 AB CE FO 00 00 00 00 00 00 00 06 


Output block G 7: 
00000: 82 2B E9 07 96 37 44 95 75 36 3F A7 07 F8 40 22 


The result G = G1 | e2 | G_3 | G4 | G_5 | G6 | am: 
00000: 8C A2 B6 82 A7 50 65 3F 8E BF 08 E7 9F 99 4D 5C 
00010: F6 A6 A5 BA 58 14 1E ED 23 DC 31 68 D2 35 89 Al 
00020: 4A 07 SF 86 05 87 72 94 1D 8E 7D F8 32 F4 23 71 
00030: 23 35 66 AF 61 DD FE A7 B1 68 3F BA BO 52 4A D7 
00040: A8 09 6D BC E8 BB 52 FC DE 6E 03 70 C1 66 95 E8 
00050: C6 E3 6E 8E 5B 82 AA C4 A6 6C 14 8D B1 F6 9B EF 
00060: 82 2B E9 07 96 37 44 95 75 36 3F A7 07 F8 40 22 
The result ciphertext C = P (xor) MSB_{|P|}(G): 

00000: 9D 80 85 C6 F2 36 12 3F 71 51 D5 2B 24 33 D4 D4 
00010: F6 B7 87 89 1C 41 78 9A AB 45 9B D3 1E DB 76 AB 
00020: 5B 25 6C C2 50 El 05 1C 84 24 C6 34 DC OB 29 71 
00030: 01 06 22 FA 07 AA 76 3E 1B D3 F3 54 4F 58 4A C6 
00040: 9B 4D 38 DA 9F 33 CB 56 65 A2 ED 8F CB 66 84 CA 
00050: 82 B6 08 F9 D3 1B 00 7F 6A 82 EB 87 B1 E7 B9 DC 
00060: D7 4D 9E 8F OF 9D FF 59 9B C9 35 A7 16 DA 73 66 


Smyshlyaev Informational [Page 58] 


RFC 8645 


Re-keying Mechanisms for Symmetric Keys 


GCM-ACPKM-—Master mode with AES-256 


KKKEKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK 


k = 192 

n = 128 

c for the CTR-ACPKM mode = 64 

c for the GCM-ACPKM-Master mode 32 

Tx = 384 

N = 256 

Initial key K: 

00000: 00 00 00 00 00 00 00 00 00 00 00 

00010: 00 00 00 00 00 00 00 00 

Additional data A: 

00000: 11 22 33 

Plaintext: 

00000: 00 00 00 00 00 00 00 00 00 00 00 

00010: 00 00 00 00 00 00 00 00 00 00 00 

00020: 00 00 00 00 00 00 00 00 00 00 00 

00030: 00 00 00 00 00 00 00 00 00 00 00 

00040: 00 00 00 00 00 00 00 00 00 00 00 

ICN: 

00000: 00 00 00 00 00 00 00 00 00 00 00 

Number of sections: 

RAL | K^2 | K^3: 

00000: 93 BA AF FB 35 FB E7 39 C1 7C 6A 

00010: 7B 89 FO BF 8B 18 07 05 96 48 68 

00020: CD 5D AC E2 OD 47 D9 18 D7 86 DO 

00030: F5 F8 B1 06 D2 71 78 B1 BO 08 C9 

00040: 5A 2D 3C BE F1 6E 67 3C 

Encrypted GCTR_1 | . | GCTR_5 

00000: 43 FA 71 81 64 B1 E3 D7 1E 7B 65 

00010: 69 9B 9E 1B 43 24 B7 52 95 74 E7 

00020: 11 62 C9 90 2A 2B 77 7F DY 6A D6 

00030: 4B 91 D4 29 E3 1A 8C 11 AF F0 BC 

00040: 40 1C C1 18 14 63 8E 76 24 83 37 

Ciphertext C: 

00000: 43 FA 71 81 64 B1 E3 D7 1E 7B 65 

00010: 69 9B 9E 1B 43 24 B7 52 95 74 E7 

00020: 11 62 C9 90 2A 2B 77 7F DY 6A D6 

00030: 4B 91 D4 29 E3 1A 8C 11 AF F0 BC 

00040: 40 1C C1 18 14 63 8E 76 24 83 37 
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GHASH input: 


00000: 11 22 33 00 00 00 00 00 00 00 00 00 00 00 00 00 
00010: 43 FA 71 81 64 B1 E3 D7 1E 7B 65 39 A7 02 1D 52 
00020: 69 9B 9E 1B 43 24 B7 52 95 74 E7 90 F2 BE 60 E8 
00030: 11 62 C9 90 2A 2B 77 7F D9 6A D6 1A 99 EO C6 DE 
00040: 4B 91 D4 29 E3 1A 8C 11 AF FO BC 47 F6 80 AF 14 
00050: 40 1C C1 18 14 63 8E 76 24 83 37 75 16 34 70 08 
00060: 00 00 00 00 00 00 00 18 00 00 00 00 00 00 02 80 


GHASH output S: 
00000: 6E A3 4B D5 6A C5 40 B7 3E 55 D5 86 D1 CC 09 7D 


Authentication tag T: 
00050: CC 3A BA 11 8C E7 85 FD 77 78 94 D4 B5 20 69 F8 


The result C | Es 


00000: 43 FA 71 81 64 B1 E3 D7 1E 7B 65 39 A7 02 1D 52 
00010: 69 9B 9E 1B 43 24 B7 52 95 74 E7 90 F2 BE 60 E8 
00020: 11 62 C9 90 2A 2B 77 7F D9 6A D6 1A 99 EO C6 DE 
00030: 4B 91 D4 29 E3 1A 8C 11 AF FO BC 47 F6 80 AF 14 
00040: 40 1C C1 18 14 63 8E 76 24 83 37 75 16 34 70 08 
00050: CC 3A BA 11 8C E7 85 FD 77 78 94 D4 B5 20 69 F8 


CBC-ACPKM-Master mode with AES-256 


kkkxkxkxkxkxkxkxkxkxkxkxkxkxkxkkxkxkxkkkxkkxkkkxkkkkxxkxx*k 


k = 256 
n = 128 
c for the CTR-ACPKM mode = 64 
N = 256 
T* = 512 


Initial key K: 
00000: 88 99 AA BB CC DD EE FF 00 11 22 33 44 55 66 77 
00010: FE DC BA 98 76 54 32 10 01 23 45 67 89 AB CD EF 


Initial vector IV: 
00000: 12 34 56 78 90 AB CE FO Al B2 C3 D4 E5 FO 01 12 


Plaintext P: 


00000: 11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88 
00010: 00 11 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 
00020: 11 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 
00030: 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 
00040: 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 
00050: 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 33 
00060: 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 33 44 
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K^1 | K^2 | K^3 | K^4: 


00000: 9F 10 BB F1 3A 79 FB BD 4A 4C A8 64 C4 90 74 64 
00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 A4 79 28 3C 60 
00020: 77 91 17 50 EO D1 77 E5 9A 13 78 2B F1 89 08 DO 
00030: AB 6B 59 EE 92 49 05 B3 AB C7 A4 E3 69 65 76 C3 
00040: E8 76 2B 30 8B 08 EB CE 3E 93 9A C2 C0 3E 76 D4 
00050: 60 9A AB D9 15 33 13 D3 CF D3 94 E7 75 DF 3A 94 
00060: F2 EE 91 45 6B DC 3D E4 91 2C 87 C3 29 CF 31 A9 
00070: 2F 20 2E 5A C4 9A 2A 65 31 33 D6 74 8C 4F F9 12 


Section_1 


KAT 
00000: 9F 10 BB F1 3A 79 FB BD 4A 4C A8 64 C4 90 74 64 
00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 A4 79 28 3C 60 


Plaintext block P 1: 
00000: 11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88 


Input block P_1 (xor) C 0: 


00000: 03 16 65 3C C5 CD B9 FO 5E 5C 1E 18 5E 5A 98 9A 


Output block C_1: 
00000: 59 CB 5B CA C2 69 2C 60 OD 46 03 AO C7 40 C9 7C 


Plaintext block P 2: 
00000: 00 11 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 


Input block P 2 (xor) C 1: 
00000: 59 DA 79 F9 86 3C 4A 17 85 DF A9 1B OB AE 36 76 


Output block C 2: 
00000: 80 B6 02 74 54 8B F7 C9 78 1F Al 05 8B F6 8B 42 


Section 2 


K*2: 
00000: 77 91 17 50 EO D1 77 E5 9A 13 78 2B F1 89 08 DO 
00010: AB 6B 59 EE 92 49 05 B3 AB C7 A4 E3 69 65 76 C3 


Plaintext block P_3: 
00000: 11 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 


Input block P_3 (xor) C_2: 
00000: 91 94 31 30 01 ED 80 41 El B5 1A C9 65 09 81 42 


Output block C_3: 
00000: 8C 24 FB CF 68 15 B1 AF 65 FE 47 75 95 B4 97 59 
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Plaintext block P_4: 
00000: 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 


Input block P 4 (xor) C 3: 
00000: AE 17 BF 9A OE 62 39 36 CF 45 8B 9B 6A BE 97 48 


Output block C_4: 
00000: 19 65 A5 00 58 OD 50 23 72 1B E9 90 E1 83 30 E9 


Section_3 


KASS 
00000: E8 76 2B 30 8B 08 EB CE 3E 93 9A C2 C0 3E 76 D4 
00010: 60 9A AB D9 15 33 13 D3 CF D3 94 E7 75 DF 3A 94 


Plaintext block P_B5: 
00000: 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 


Input block P 5 (xor) C 4: 
00000: 2A 21 FO 66 2F 85 C9 89 C9 D7 07 6F EB 83 21 CB 


Output block C 5: 
00000: 56 D8 34 F4 6F OF 4D E6 20 53 A9 5C B5 F6 3C 14 


Plaintext block P 6: 
00000: 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 33 


Input block P_6 (xor) C_5: 
00000: 12 8D 52 83 E7 96 E7 5D EC BD 56 56 B5 E7 1E 27 


Output block C_6: 
00000: 66 68 2B 8B DD 6E B2 7E DE C7 51 D6 2F 45 A5 45 


Section_4 


K^4: 
00000: F2 EE 91 45 6B DC 3D E4 91 2C 87 C3 29 CF 31 A9 
00010: 2F 20 2E 5A C4 9A 2A 65 31 33 D6 74 8C 4F F9 12 


Plaintext block P 7: 
00000: 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 33 44 


Input block P 7 (xor) C 6: 
00000: 33 0E 5C 03 44 C4 09 B2 30 38 5B D6 3E 67 96 01 


Output block C 7: 
00000: 7F 4D 87 F9 CA E9 56 09 79 C4 FA FE 34 OB 45 34 
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Ciphertext C: 
00000: 59 CB 


00010: 80 B6 
00020: 8C 24 
00030: 19 65 
00040: 56 D8 
00050: 66 68 


00060: 7F 4D 


Re-keying 
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CFB-ACPKM-Master mode with AES-256 


KKKEKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK 


c for the CTR-ACPKM mode 


k = 256 
n = 128 
N = 256 
T* = 512 


Initial key K: 
00000: 88 99 
00010: FE DC 


Initial vector 
00000: 12 34 


Plaintext P: 


00000: 11 22 
00010: 00 11 
00020: 11 22 


00030: 22 33 
00040: 33 44 
00050: 44 55 
00060: 55 66 


K^l1 | K^2 | K^ 
00000: 9F 10 
00010: 39 FE 
00020: TE D1 
00030: AB 6B 
00040: E8 76 
00050: 60 9A 
00060: F2 EE 
00070: 2F 20 
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Section 1 


K*1: 

00000: 9F 10 BB Fl 3A 79 FB BD 4A 4C A8 
00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 
Plaintext block P 1: 

00000: 11 22 33 44 55 66 77 00 FF EE DD 
Encrypted block E (K“1)(C 0): 

00000: 1C 39 9D 59 F8 5D 91 91 A9 D2 12 
Output block C 1 = E_{K%1}(C_0) (xor) P 1: 


00000: 


Re-keying Mechanisms for 


OD 1B AE 1D AD 3B E6 91 56 3C CF 


Plaintext block P_2: 


00000: 


00 11 22 33 44 55 66 77 88 99 AA 


Encrypted block E (K“1)(C 1): 


00000: 


Output block C 2 = 


00000: 


Section 2 


K*2: 
00000: 
00010: 


6B A2 C5 42 52 69 C6 0B 15 14 06 


E_{K*1}(C_1) (xor) 
6B B3 E7 71 16 3C AO 7C 9D 8D AC 


77 91 17 50 EO D1 77 E5 9A 13 78 
AB 6B 59 EE 92 49 05 B3 AB C7 A4 


Plaintext block P_3: 


00000: 


11 22 33 44 55 66 77 88 99 AA BB 


Encrypted block E (K“2)(C 2): 


00000: 


Output block C 3 = 


00000: 


95 45 5F DB C3 9E OA 13 9F CB 10 


E (K“2)(C 2) (xor) 
84 67 6C 9F 96 F8 7D 9B 06 61 AB 


Plaintext block P_4: 


00000: 


22 33 44 55 66 77 88 99 AA BB CC 


Encrypted block E (K“2)(C 3): 


00000: 


Output block C 4 = 


00000: 


Smyshlyaev 


EO AA 32 5D 80 A4 47 95 BA 42 BF 


E (K“2)(C 3) (xor) 
C2 99 76 08 E6 D3 CF OC 10 F9 73 
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Section 3 


Kr sie 
00000: E8 
00010: 60 


Plaintext bl 
00000: 33 


Encrypted bl 
00000: FE 


Output block C_5 = 


00000: CD 


Plaintext bl 
00000: 44 


Encrypted bl 
00000: 01 


Output block C_6 = 


00000: 45 


Section 4 


K4: 
00000: F2 
00010: 2F 


Plaintext bl 
00000: 55 


Encrypted bl 
00000: 97 


Output block C 7 = 
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76 2B 30 8B 08 EB CE 3E 93 
9A AB D9 15 33 13 D3 CF D3 


9A 
94 


lock P_5: 


44 55 66 77 88 99 AA BB CC EE 


lock E (K“3)(C 4): 

42 8C 70 C2 51 CE 13 36 Cl BF 
E (K“3) (C 4) (xor) P 5: 
06 D9 16 B5 D9 57 B9 8D OD 51 


lock P 6: 
55 66 77 88 99 AA BB CC EF FF 


lock E (K“3)(C 5): 
24 80 87 86 18 A5 43 11 OA CC 


E (K“3)(C 5) (xor) P 6: 
71 E6 FO OF 81 OF F8 DD E4 33 


EE 91 45 6B DC 3D E4 91 2C 87 
20 25 5A C4 9A 2A 65 31 33 D6 


lock P 7: 
66 77 88 99 AA BB CC 


lock MSB_{|P_7|} (E_{K*4} (C_6)): 
5C 96 37 55 1E 8C 7F 


3A El BF CC B4 37 B3 
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00000: C2 
Ciphertext C: 
00000: OD 
00010: 6B 
00020: 84 
00030: C2 
00040: CD 
00050: 45 
00060: C2 
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C2 
E7 


FF 


44 


BB 


OA 


B5 


BF 


C3 
74 


MSB_{|P_7|} (E_{K*4} (C_6)) 


53 
3C 
39 
8D 
BB 
BF 


CO 
ED 


OA 


F8 


F2 


00 


OA 


OA 


29 
8C 


3E 
DF 


00 


49 


49 


11 


E5 


F4 


CF 
4F 


(xor) 


D8 
SC 
53 
07 
F2 
OA 


BF 
A8 
86 
40 
49 
F4 
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76 
3A 


11 


66 


77 


22 


02 


20 


31 
F9 


D4 
94 


22 


89 


AB 


33 


A3 


90 


A9 
12 


8B 
24 
88 
A3 
AB 
90 
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OMAC-ACPKM-Master mode with AES-256 


KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK 


k = 256 
n = 128 
c for the CTR-ACPKM mode = 64 
N = 256 
T* = 768 


Initial key K: 
00000: 88 99 AA BB CC DD EE FF 00 11 22 33 44 55 66 77 
00010: FE DC BA 98 76 54 32 10 01 23 45 67 89 AB CD EF 


Plaintext M: 


00000: 11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88 
00010: 00 11 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 
00020: 11 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 
00030: 22 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 
00040: 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 


K^1 | K^1_1 | K^2 | K^2_1 | K^3 | K^3_1: 


00000: 9F 10 BB F1 3A 79 FB BD 4A 4C A8 64 C4 90 74 64 
00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 A4 79 28 3C 60 
00020: 77 91 17 50 EO D1 77 E5 9A 13 78 2B F1 89 08 DO 
00030: AB 6B 59 EE 92 49 05 B3 AB C7 A4 E3 69 65 76 C3 
00040: 9D CC 66 42 OD FF 45 5B 21 F3 93 FO D4 D6 6E 67 
00050: BB 1B 06 0B 87 66 6D 08 7A 9D A7 49 55 C3 5B 48 
00060: F2 EE 91 45 6B DC 3D E4 91 2C 87 C3 29 CF 31 A9 
00070: 2F 20 2E 5A C4 9A 2A 65 31 33 D6 74 8C 4F F9 12 


00080: 78 21 C7 C7 6C BD 79 63 56 AC F8 8E 69 6A 00 07 
Section_1 

Kls 

00000: 9F 10 BB F1 3A 79 FB BD 4A 4C A8 64 C4 90 74 64 
00010: 39 FE 50 6D 4B 86 9B 21 03 A3 B6 A4 79 28 3C 60 


KIT 
00000: 77 91 17 50 EO D1 77 E5 9A 13 78 2B F1 89 08 DO 


Plaintext block M 1: 
00000: 11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88 


Input block M1 (xor) C 0: 
00000: 11 22 33 44 55 66 77 00 FF EE DD CC BB AA 99 88 


Output block C 1: 
00000: OB A5 89 BF 55 C1 15 42 53 08 89 76 AO FE 24 3E 
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Plaintext block M 2: 


ing Mechanisms for 


00000: 00 11 22 33 44 55 66 77 88 99 AA 
Input block M_2 (xor) C 1: 
00000: OB B4 AB 8C 11 94 73 35 DB 91 23 
Output block C 2: 
00000: 1C 53 DD A3 6D DC El 17 ED 1F 14 
Section 2 
K“2: 
00000: AB 6B 59 EE 92 49 05 B3 AB C7 A4 
00010: 9D CC 66 42 OD FF 45 5B 21 F3 93 
KA?) T; 
00000: BB 1B 06 OB 87 66 6D 08 7A 9D A7 
Plaintext block M_3: 
00000: 11 22 33 44 55 66 77 88 99 AA BB 
Input block M_3 (xor) C_2: 
00000: OD 71 EE E7 38 BA 96 9F 74 B5 AF 
Output block C_3: 
00000: 4E D4 BC A6 CE 6D 6D 16 F8 63 85 
Plaintext block M_4: 
00000: 22 33 44 55 66 77 88 99 AA BB CC 
Input block M_4 (xor) C_3: 
00000: 6C E7 F8 F3 A8 1A E5 8F 52 D8 49 
Output block C 4: 
00000: B6 83 E3 96 FD 30 CD 46 79 C1 8B 
Section_3 
K* 3: 
00000: F2 EE 91 45 6B DC 3D E4 91 2C 87 
00010: 2F 20 2E 5A C4 9A 2A 65 31 33 D6 
K*3_1: 
00000: 78 21 C7 C7 6C BD 79 63 56 AC F8 
MSB1 (K1) == 0 -> K2 = K1 << 1 
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BB 


CD 


09 


E3 


FO 


49 


CC 


CS 


13 


EE 


FD 


24 


C3 


74 


8E 


CC 


6C 


D8 


69 


D4 


55 


EE 


36 


EO 


FF 


1F 


03 


29 


8C 


69 


EE 


10 


6A 


65 


D6 


C3 


FF 


95 


48 


OA 


42 


82 


CF 


4F 


6A 
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EF 


DB 


F3 


76 


6E 


5B 


OA 


F9 


59 


00 


59 


1D 


3 


F9 


00 


OA 


34 


2C 


C3 


67 


48 


00 


2C 


ES 


11 


64 


81 


AQ 


12 


07 
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K1: 
00000: 78 21 C7 CT 6C BD 79 63 56 AC F8 8E 69 6A 00 07 


K2: 
00000: FO 43 8F 8E D9 7A F2 C6 AD 59 F1 1C D2 D4 00 OF 


Plaintext M 5: 
00000: 33 44 55 66 77 88 99 AA BB CC EE FF OA 00 11 22 


Using Kl, padding is not reguired 


Input block M 5 (xor) C 4: 
00000: FD E6 71 37 E6 05 2D 8F 94 Al 9D 55 60 E8 OC A4 


Output block C 5: 
00000: B3 AD B8 92 18 32 05 4C 09 21 E7 B8 08 CF AO B8 


Message authentication code T: 
00000: B3 AD B8 92 18 32 05 4C 09 21 E7 B8 08 CF AO B8 
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